diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-09-23 17:14:49 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2021-09-24 11:11:11 +0200 |
| commit | 28a9bc70536a1319235f868c5f942f73cd5e6b21 (patch) | |
| tree | 4ee49bb7b901a38d61f1390e44dda264581bb282 /connectivity | |
| parent | Adapt solenv/flatpak-manifest.in to recent download.lst changes (diff) | |
| download | core-28a9bc70536a1319235f868c5f942f73cd5e6b21.tar.gz core-28a9bc70536a1319235f868c5f942f73cd5e6b21.zip | |
check claimed number of records against max possible with available data
Change-Id: I50d9354da00137c64c83970eb66792b37d7e545a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/122443
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Diffstat (limited to 'connectivity')
| -rw-r--r-- | connectivity/source/drivers/dbase/DTable.cxx | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx index 5b1ea452f61a..0872ff07e181 100644 --- a/connectivity/source/drivers/dbase/DTable.cxx +++ b/connectivity/source/drivers/dbase/DTable.cxx @@ -273,7 +273,11 @@ void ODbaseTable::readHeader() void ODbaseTable::fillColumns() { m_pFileStream->Seek(STREAM_SEEK_TO_BEGIN); - m_pFileStream->Seek(32); + if (!checkSeek(*m_pFileStream, 32)) + { + SAL_WARN("connectivity.drivers", "ODbaseTable::fillColumns: bad offset!"); + return; + } if(!m_aColumns.is()) m_aColumns = new OSQLColumns(); @@ -285,8 +289,21 @@ void ODbaseTable::fillColumns() m_aScales.clear(); // Number of fields: - const sal_Int32 nFieldCount = (m_aHeader.headerLength - 1) / 32 - 1; - OSL_ENSURE(nFieldCount,"No columns in table!"); + sal_Int32 nFieldCount = (m_aHeader.headerLength - 1) / 32 - 1; + if (nFieldCount <= 0) + { + SAL_WARN("connectivity.drivers", "No columns in table!"); + return; + } + + auto nRemainingsize = m_pFileStream->remainingSize(); + auto nMaxPossibleRecords = nRemainingsize / 32; + if (o3tl::make_unsigned(nFieldCount) > nMaxPossibleRecords) + { + SAL_WARN("connectivity.drivers", "Parsing error: " << nMaxPossibleRecords << + " max possible entries, but " << nFieldCount << " claimed, truncating"); + nFieldCount = nMaxPossibleRecords; + } m_aColumns->reserve(nFieldCount); m_aTypes.reserve(nFieldCount); |