diff options
author | Caolán McNamara <caolanm@redhat.com> | 2022-01-16 14:30:15 +0000 |
---|---|---|
committer | Aron Budea <aron.budea@collabora.com> | 2022-08-10 22:41:39 +0200 |
commit | 6be520c55f0ef104140c0b99de88918602ee7e5e (patch) | |
tree | 40eb8ab73364a3ba3adabd6c2ab65bbcca83abfb /lotuswordpro | |
parent | ofz#43446 Undefined-shift (diff) | |
download | core-6be520c55f0ef104140c0b99de88918602ee7e5e.tar.gz core-6be520c55f0ef104140c0b99de88918602ee7e5e.zip |
ofz: Use-of-uninitialized-value
Change-Id: Ib1c3b306573dda073f6ff3d7d0cc17aef39c0a0e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128436
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 7607a7e45a1da570dda0a4b96c08405086a647b6)
Diffstat (limited to 'lotuswordpro')
-rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 0c2c97cde9b8..4ffffb2fa536 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -497,7 +497,7 @@ void LwpDrawPolyLine::Read() m_pStream->ReadUChar( m_aPolyLineRec.aPenColor.unused ); m_pStream->ReadUInt16( m_aPolyLineRec.nNumPoints ); - if (m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4) + if (!m_pStream->good() || m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4) throw BadRead(); m_pVector.reset( new SdwPoint[m_aPolyLineRec.nNumPoints] ); @@ -577,7 +577,7 @@ void LwpDrawPolygon::Read() ReadClosedObjStyle(); m_pStream->ReadUInt16( m_nNumPoints ); - if (m_nNumPoints > m_pStream->remainingSize() / 4) + if (!m_pStream->good() || m_nNumPoints > m_pStream->remainingSize() / 4) throw BadRead(); m_pVector.reset( new SdwPoint[m_nNumPoints] ); @@ -1041,6 +1041,9 @@ void LwpDrawTextBox::Read() m_pStream->ReadInt16( m_aTextRec.nTextRotation ); m_pStream->ReadInt16( m_aTextRec.nTextExtraSpacing ); + if (!m_pStream->good()) + throw BadRead(); + // some draw files in version 1.2 have an extra byte following '\0'. // can't rely on that, so read in the whole string into memory. @@ -1192,17 +1195,17 @@ void LwpDrawTextArt::Read() m_pStream->ReadInt16( m_aTextArtRec.nRotation ); sal_uInt16 nPointNumber; - sal_Int16 nX, nY; m_pStream->ReadUInt16( nPointNumber ); size_t nPoints = nPointNumber*3+1; - if (nPoints > m_pStream->remainingSize() / 4) + if (!m_pStream->good() || nPoints > m_pStream->remainingSize() / 4) throw BadRead(); m_aTextArtRec.aPath[0].n = nPointNumber; m_aTextArtRec.aPath[0].pPts = new SdwPoint[nPoints]; for (size_t nPt = 0; nPt < nPoints; ++nPt) { + sal_Int16 nX, nY; m_pStream->ReadInt16( nX ); m_pStream->ReadInt16( nY ); m_aTextArtRec.aPath[0].pPts[nPt].x = nX; @@ -1212,13 +1215,14 @@ void LwpDrawTextArt::Read() m_pStream->ReadUInt16( nPointNumber ); nPoints = nPointNumber*3+1; - if (nPoints > m_pStream->remainingSize() / 4) + if (!m_pStream->good() || nPoints > m_pStream->remainingSize() / 4) throw BadRead(); m_aTextArtRec.aPath[1].n = nPointNumber; m_aTextArtRec.aPath[1].pPts = new SdwPoint[nPoints]; for (size_t nPt = 0; nPt < nPoints; ++nPt) { + sal_Int16 nX, nY; m_pStream->ReadInt16( nX ); m_pStream->ReadInt16( nY ); m_aTextArtRec.aPath[1].pPts[nPt].x = nX; @@ -1246,7 +1250,7 @@ void LwpDrawTextArt::Read() - (m_aTextArtRec.aPath[1].n*3 + 1)*4; - if (m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + if (!m_pStream->good() || m_aTextArtRec.nTextLen > m_pStream->remainingSize()) throw BadRead(); m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen]; @@ -1384,7 +1388,7 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); - if (!IsValid(aInfoHeader2)) + if (!m_pStream->good() || !IsValid(aInfoHeader2)) throw BadRead(); N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; @@ -1404,7 +1408,7 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); - if (!IsValid(aInfoHeader2)) + if (!m_pStream->good() || !IsValid(aInfoHeader2)) throw BadRead(); N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; |