1 files changed, 27 insertions, 16 deletions

diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 8e4a96c726d0..98a8e56aa5e5 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -20,7 +20,8 @@
 #include "precompile.h"
 
 #include <comphelper/newarray.hxx>
-#include <unotools/configmgr.hxx>
+#include <comphelper/configuration.hxx>
+#include <sal/log.hxx>
 #include <tools/long.hxx>
 
 #include <assert.h>
@@ -91,10 +92,12 @@ bool FieldCode::Read(HWPFile & hwpf)
     str2.reset( new hchar[len2_ ? len2_ : 1] );
     str3.reset( new hchar[len3_ ? len3_ : 1] );
 
-    hwpf.Read2b(str1.get(), len1_);
+    if (hwpf.Read2b(str1.get(), len1_) != len1_)
+        return false;
     hwpf.SkipBlock(len1 - (len1_ * sizeof(hchar)));
     str1[len1_ ? (len1_ - 1) : 0] = 0;
-    hwpf.Read2b(str2.get(), len2_);
+    if (hwpf.Read2b(str2.get(), len2_) != len2_)
+        return false;
     hwpf.SkipBlock(len2 - (len2_ * sizeof(hchar)));
     str2[len2_ ? (len2_ - 1) : 0] = 0;
     if (hwpf.Read2b(str3.get(), len3_) != len3_)
@@ -106,7 +109,7 @@ bool FieldCode::Read(HWPFile & hwpf)
 
     if( type[0] == 3 && type[1] == 2 ){ /* It must create a format as created date. */
           DateCode *pDate = new DateCode;
-          for (int i = 0 ; i < static_cast<int>(len3_); i++) {
+          for (uint i = 0 ; i < len3_; i++) {
                 if(str3[i] == 0 ) break;
                 if( i >= DATE_SIZE ) break;
                 pDate->format[i] = str3[i];
@@ -221,7 +224,6 @@ bool TxtBox::Read(HWPFile & hwpf)
     if (hh != dummy || CH_TEXT_BOX != dummy) {
         return hwpf.SetState(HWP_InvalidFileFormat);
     }
-    hwpf.AddBox(this);
     hwpf.Read2b(&style.cap_len, 1);
     hwpf.Read2b(&dummy1, 1);
     unsigned short next;
@@ -237,7 +239,6 @@ bool TxtBox::Read(HWPFile & hwpf)
     hwpf.Read2b(&option, 1);
     hwpf.Read2b(&ctrl_ch, 1);
     hwpf.Read2b(style.margin, 12);
-    hwpf.AddFBoxStyle(&style);
     hwpf.Read2b(&box_xs, 1);
     hwpf.Read2b(&box_ys, 1);
     hwpf.Read2b(&cap_xs, 1);
@@ -290,7 +291,7 @@ bool TxtBox::Read(HWPFile & hwpf)
         return hwpf.SetState(HWP_InvalidFileFormat);
     }
 
-    if (ncell > 4096 && utl::ConfigManager::IsFuzzing()) {
+    if (ncell > 4096 && comphelper::IsFuzzing()) {
         // cut off at an arbitrary size to speed up fuzzing
         return hwpf.SetState(HWP_InvalidFileFormat);
     }
@@ -366,7 +367,10 @@ bool TxtBox::Read(HWPFile & hwpf)
     else
         m_pTable = nullptr;
 
-    return !hwpf.State();
+    bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 namespace
@@ -400,7 +404,6 @@ bool Picture::Read(HWPFile & hwpf)
     if (hh != dummy || CH_PICTURE != dummy) {
         return hwpf.SetState(HWP_InvalidFileFormat);
     }
-    hwpf.AddBox(this);
 
     hwpf.Read4b(follow_block_size);
 
@@ -455,6 +458,7 @@ bool Picture::Read(HWPFile & hwpf)
     scale[1] = tmp16;
 
     hwpf.ReadBlock(picinfo.picun.path, 256);      /* Picture File Name: when type is not a Drawing. */
+    picinfo.picun.path[255] = 0; // ensure null terminated
     hwpf.ReadBlock(reserved3, 9);                 /* Brightness / Contrast / Picture Effect, etc. */
 
     UpdateBBox(this);
@@ -487,14 +491,18 @@ bool Picture::Read(HWPFile & hwpf)
            if (nBlock != nReadBlock)
                break;
            if (nMaxAllowedDecompression && follow.size() > nMaxAllowedDecompression)
-               break;
+           {
+               SAL_WARN("filter.hwp", "too much decompression, abandoning");
+               follow.clear();
+               return false;
+           }
         }
         follow_block_size = follow.size();
 
         if (pictype == PICTYPE_DRAW)
         {
             auto xGuard(std::make_unique<ChangeMemGuard>(follow.data(), follow_block_size));
-            LoadDrawingObjectBlock(this);
+            LoadDrawingObjectBlock(this, hwpf);
             style.cell = picinfo.picdraw.hdo;
             xGuard.reset();
         }
@@ -511,12 +519,14 @@ bool Picture::Read(HWPFile & hwpf)
         style.boxtype = 'G';
     else
         style.boxtype = 'D';
-    hwpf.AddFBoxStyle(&style);
 
 // caption
     hwpf.ReadParaList(caption);
 
-    return !hwpf.State();
+    bool bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 // line(15)
@@ -541,7 +551,6 @@ bool Line::Read(HWPFile & hwpf)
     if (hh != dummy || CH_LINE != dummy) {
         return hwpf.SetState(HWP_InvalidFileFormat);
     }
-    hwpf.AddBox(this);
 
     style.boxnum = fboxnum++;
     zorder = zindex++;
@@ -554,7 +563,6 @@ bool Line::Read(HWPFile & hwpf)
     hwpf.Read2b(&option, 1);
     hwpf.Read2b(&ctrl_ch, 1);
     hwpf.Read2b(style.margin, 12);
-    hwpf.AddFBoxStyle(&style);
     hwpf.Read2b(&box_xs, 1);
     hwpf.Read2b(&box_ys, 1);
     hwpf.Read2b(&cap_xs, 1);
@@ -583,7 +591,10 @@ bool Line::Read(HWPFile & hwpf)
     hwpf.Read2b(&color, 1);
     style.xpos = width;
 
-    return !hwpf.State();
+    bool bSuccess = !hwpf.State();
+    if (bSuccess)
+        hwpf.AddFBoxStyle(&style);
+    return bSuccess;
 }
 
 // hidden(15)