summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2020-10-18 20:36:16 +0100
committerAndras Timar <andras.timar@collabora.com>2021-10-19 13:57:44 +0200
commit3d5a63591d66068596c57f18d7210b871a43d014 (patch)
tree4d6cda68be6907dc4414f11b62a4d4b1072341d4
parentofz#26122 allow NINSIZE input full elements (diff)
downloadcore-3d5a63591d66068596c57f18d7210b871a43d014.tar.gz
core-3d5a63591d66068596c57f18d7210b871a43d014.zip
ofz#26480 validate WW8PLCFpcd is sorted like WW8PLCF does
Change-Id: I11393c730986585aeea229ebeec6417e4a0578d9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104510 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7f55db80c6fe42c162bbf51404e638a66b6ae9ab)
-rw-r--r--sw/source/filter/ww8/ww8scan.cxx37
-rw-r--r--sw/source/filter/ww8/ww8scan.hxx6
2 files changed, 30 insertions, 13 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 643601e144e3..e8e0c06db234 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2331,26 +2331,40 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
void WW8PLCF::MakeFailedPLCF()
{
nIMax = 0;
- pPLCF_PosArray.reset( new sal_Int32[2] );
+ pPLCF_PosArray.reset( new WW8_CP[2] );
pPLCF_PosArray[0] = pPLCF_PosArray[1] = WW8_CP_MAX;
pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
}
-void WW8PLCF::TruncToSortedRange()
+namespace
{
- //Docs state that: ... all Plcs ... are sorted in ascending order.
- //So ensure that here for broken documents.
- for (auto nI = 0; nI < nIMax; ++nI)
+ sal_Int32 TruncToSortedRange(const sal_Int32* pPLCF_PosArray, sal_Int32 nIMax)
{
- if (pPLCF_PosArray[nI] > pPLCF_PosArray[nI+1])
+ //Docs state that: ... all Plcs ... are sorted in ascending order.
+ //So ensure that here for broken documents.
+ for (auto nI = 0; nI < nIMax; ++nI)
{
- SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
- nIMax = nI;
- break;
+ if (pPLCF_PosArray[nI] > pPLCF_PosArray[nI+1])
+ {
+ SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion");
+ nIMax = nI;
+ break;
+ }
}
+ return nIMax;
}
}
+void WW8PLCFpcd::TruncToSortedRange()
+{
+ nIMax = ::TruncToSortedRange(pPLCF_PosArray.get(), nIMax);
+}
+
+void WW8PLCF::TruncToSortedRange()
+{
+ nIMax = ::TruncToSortedRange(pPLCF_PosArray.get(), nIMax);
+}
+
void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
{
OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" );
@@ -2372,7 +2386,7 @@ void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
{
size_t nSiz = (4 + nStru) * nIMax + 4;
size_t nElems = ( nSiz + 3 ) / 4;
- pPLCF_PosArray.reset( new sal_Int32[ nElems ] ); // Pointer to Pos-array
+ pPLCF_PosArray.reset( new WW8_CP[ nElems ] ); // Pointer to Pos-array
for (sal_Int32 i = 0; i < ncpN && !failure; ++i)
{
@@ -2506,7 +2520,7 @@ WW8PLCFpcd::WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos,
bValid = false;
nPLCF = bValid ? std::min(nRemainingSize, static_cast<std::size_t>(nPLCF)) : nValidMin;
- pPLCF_PosArray.reset( new sal_Int32[ ( nPLCF + 3 ) / 4 ] ); // Pointer to Pos-array
+ pPLCF_PosArray.reset( new WW8_CP[ ( nPLCF + 3 ) / 4 ] ); // Pointer to Pos-array
pPLCF_PosArray[0] = 0;
nPLCF = bValid ? pSt->ReadBytes(pPLCF_PosArray.get(), nPLCF) : nValidMin;
@@ -2520,6 +2534,7 @@ WW8PLCFpcd::WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos,
// Pointer to content array
pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]);
+ TruncToSortedRange();
pSt->Seek( nOldPos );
}
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 3eae6d1b30b3..e8f6db496950 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -346,14 +346,16 @@ class WW8PLCFpcd
{
friend class WW8PLCFpcd_Iter;
- std::unique_ptr<sal_Int32[]> pPLCF_PosArray; // pointer to Pos-array and the whole structure
+ std::unique_ptr<WW8_CP[]> pPLCF_PosArray; // pointer to Pos-array and the whole structure
sal_uInt8* pPLCF_Contents; // pointer to content-array-part of Pos-array
- long nIMax;
+ sal_Int32 nIMax;
sal_uInt32 nStru;
WW8PLCFpcd(const WW8PLCFpcd&) = delete;
WW8PLCFpcd& operator=(const WW8PLCFpcd&) = delete;
+ void TruncToSortedRange();
+
public:
WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos, sal_uInt32 nPLCF,
sal_uInt32 nStruct);