diff options
author | Caolán McNamara <caolanm@redhat.com> | 2020-10-18 20:36:16 +0100 |
---|---|---|
committer | Andras Timar <andras.timar@collabora.com> | 2021-03-22 22:34:02 +0100 |
commit | aa3b1829aef191ef6f7e16f9c6e5d15cd3da583a (patch) | |
tree | 5a838a3d613316e70d4f016e76f5edcf4408437e | |
parent | ofz#26122 allow NINSIZE input full elements (diff) | |
download | core-aa3b1829aef191ef6f7e16f9c6e5d15cd3da583a.tar.gz core-aa3b1829aef191ef6f7e16f9c6e5d15cd3da583a.zip |
ofz#26480 validate WW8PLCFpcd is sorted like WW8PLCF does
Change-Id: I11393c730986585aeea229ebeec6417e4a0578d9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104510
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 7f55db80c6fe42c162bbf51404e638a66b6ae9ab)
-rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 37 | ||||
-rw-r--r-- | sw/source/filter/ww8/ww8scan.hxx | 6 |
2 files changed, 30 insertions, 13 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 35fa751c37f0..b52469f08208 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -2334,26 +2334,40 @@ void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF) void WW8PLCF::MakeFailedPLCF() { nIMax = 0; - pPLCF_PosArray.reset( new sal_Int32[2] ); + pPLCF_PosArray.reset( new WW8_CP[2] ); pPLCF_PosArray[0] = pPLCF_PosArray[1] = WW8_CP_MAX; pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]); } -void WW8PLCF::TruncToSortedRange() +namespace { - //Docs state that: ... all Plcs ... are sorted in ascending order. - //So ensure that here for broken documents. - for (auto nI = 0; nI < nIMax; ++nI) + sal_Int32 TruncToSortedRange(const sal_Int32* pPLCF_PosArray, sal_Int32 nIMax) { - if (pPLCF_PosArray[nI] > pPLCF_PosArray[nI+1]) + //Docs state that: ... all Plcs ... are sorted in ascending order. + //So ensure that here for broken documents. + for (auto nI = 0; nI < nIMax; ++nI) { - SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion"); - nIMax = nI; - break; + if (pPLCF_PosArray[nI] > pPLCF_PosArray[nI+1]) + { + SAL_WARN("sw.ww8", "Document has unsorted PLCF, truncated to sorted portion"); + nIMax = nI; + break; + } } + return nIMax; } } +void WW8PLCFpcd::TruncToSortedRange() +{ + nIMax = ::TruncToSortedRange(pPLCF_PosArray.get(), nIMax); +} + +void WW8PLCF::TruncToSortedRange() +{ + nIMax = ::TruncToSortedRange(pPLCF_PosArray.get(), nIMax); +} + void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN) { OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Why is PLCF too big?" ); @@ -2375,7 +2389,7 @@ void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN) { size_t nSiz = (4 + nStru) * nIMax + 4; size_t nElems = ( nSiz + 3 ) / 4; - pPLCF_PosArray.reset( new sal_Int32[ nElems ] ); // Pointer to Pos-array + pPLCF_PosArray.reset( new WW8_CP[ nElems ] ); // Pointer to Pos-array for (sal_Int32 i = 0; i < ncpN && !failure; ++i) { @@ -2509,7 +2523,7 @@ WW8PLCFpcd::WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos, bValid = false; nPLCF = bValid ? std::min(nRemainingSize, static_cast<std::size_t>(nPLCF)) : nValidMin; - pPLCF_PosArray.reset( new sal_Int32[ ( nPLCF + 3 ) / 4 ] ); // Pointer to Pos-array + pPLCF_PosArray.reset( new WW8_CP[ ( nPLCF + 3 ) / 4 ] ); // Pointer to Pos-array pPLCF_PosArray[0] = 0; nPLCF = bValid ? pSt->ReadBytes(pPLCF_PosArray.get(), nPLCF) : nValidMin; @@ -2523,6 +2537,7 @@ WW8PLCFpcd::WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos, // Pointer to content array pPLCF_Contents = reinterpret_cast<sal_uInt8*>(&pPLCF_PosArray[nIMax + 1]); + TruncToSortedRange(); pSt->Seek( nOldPos ); } diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx index 1a5b024c12fb..6d01af87316e 100644 --- a/sw/source/filter/ww8/ww8scan.hxx +++ b/sw/source/filter/ww8/ww8scan.hxx @@ -339,14 +339,16 @@ class WW8PLCFpcd { friend class WW8PLCFpcd_Iter; - std::unique_ptr<sal_Int32[]> pPLCF_PosArray; // pointer to Pos-array and the whole structure + std::unique_ptr<WW8_CP[]> pPLCF_PosArray; // pointer to Pos-array and the whole structure sal_uInt8* pPLCF_Contents; // pointer to content-array-part of Pos-array - long nIMax; + sal_Int32 nIMax; sal_uInt32 nStru; WW8PLCFpcd(const WW8PLCFpcd&) = delete; WW8PLCFpcd& operator=(const WW8PLCFpcd&) = delete; + void TruncToSortedRange(); + public: WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos, sal_uInt32 nPLCF, sal_uInt32 nStruct); |