Kaydet (Commit) f7ffc93b authored tarafından Caolán McNamara's avatar Caolán McNamara

ofz: limit depth of hwp parsing

Change-Id: Iba38cdea1fa9f3df4340988184adb1e8058ae931
Reviewed-on: https://gerrit.libreoffice.org/44816Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst 6085f7a7
......@@ -87,6 +87,9 @@ HWPPara::~HWPPara()
bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
{
DepthGuard aGuard(hwpf);
if (aGuard.toodeep())
return false;
int ii;
scflag = flag;
// Paragraph Information
......
......@@ -50,6 +50,7 @@ HWPFile::HWPFile()
, info_block_len(0)
, error_code(HWP_NoError)
, oledata(nullptr)
, readdepth(0)
, m_nCurrentPage(1)
, m_nMaxSettedPage(0)
, hiodev(nullptr)
......
......@@ -275,6 +275,7 @@ class DLLEXPORT HWPFile
int error_code;
OlePicture *oledata;
unsigned char scratch[SAL_MAX_UINT16];
int readdepth;
private:
/* hwp 파일 이름 */
......@@ -310,6 +311,26 @@ class DLLEXPORT HWPFile
friend HWPFile *SetCurrentDoc(HWPFile *);
};
class DLLEXPORT DepthGuard
{
private:
HWPFile& m_rFile;
public:
DepthGuard(HWPFile &rFile)
: m_rFile(rFile)
{
++m_rFile.readdepth;
}
bool toodeep() const
{
return m_rFile.readdepth == 1024;
}
~DepthGuard()
{
--m_rFile.readdepth;
}
};
HWPFile *GetCurrentDoc(void);
HWPFile *SetCurrentDoc(HWPFile *hwpfp);
#endif // INCLUDED_HWPFILTER_SOURCE_HWPFILE_H
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment