From af8fc34702d9f7d73a81541cab2983bbdc7b6636 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 8 Feb 2018 10:29:16 +0000
Subject: ofz: timeout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ia99ce4efe5ad7740f1cae7afcc199bc164b760ca
Reviewed-on: https://gerrit.libreoffice.org/49418
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 emfio/source/reader/emfreader.cxx | 48 +++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 22 deletions(-)

(limited to 'emfio/source')

diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index fdb8dbf43cbb..38b26086993d 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -335,30 +335,34 @@ bool ImplReadRegion( tools::PolyPolygon& rPolyPoly, SvStream& rStream, sal_uInt3
     rStream.ReadUInt32(nCount);
     rStream.ReadUInt32(nRgnSize);
 
-    if (   nCount > 0
-        && nType == RDH_RECTANGLES
-        && nLen >= ((nCount << 4) + (nHdSize - 16)))
-    {
-        sal_Int32 nx1, ny1, nx2, ny2;
+    if (!rStream.good() || nCount == 0 || nType != RDH_RECTANGLES)
+        return false;
 
-        for (i = 0; i < nCount; i++)
-        {
-            rStream.ReadInt32(nx1);
-            rStream.ReadInt32(ny1);
-            rStream.ReadInt32(nx2);
-            rStream.ReadInt32(ny2);
-
-            tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
-
-            tools::Polygon aPolygon(aRectangle);
-            tools::PolyPolygon aPolyPolyOr1(aPolygon);
-            tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
-            rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
-            rPolyPoly = aPolyPolyOr2;
-        }
-        return true;
+    sal_uInt32 nSize;
+    if (o3tl::checked_multiply<sal_uInt32>(nCount, 16, nSize))
+        return false;
+    if (o3tl::checked_add<sal_uInt32>(nSize, nHdSize - 16, nSize))
+        return false;
+    if (nLen < nSize)
+        return false;
+
+    sal_Int32 nx1, ny1, nx2, ny2;
+    for (i = 0; i < nCount; i++)
+    {
+        rStream.ReadInt32(nx1);
+        rStream.ReadInt32(ny1);
+        rStream.ReadInt32(nx2);
+        rStream.ReadInt32(ny2);
+
+        tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
+
+        tools::Polygon aPolygon(aRectangle);
+        tools::PolyPolygon aPolyPolyOr1(aPolygon);
+        tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
+        rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
+        rPolyPoly = aPolyPolyOr2;
     }
-    return false;
+    return true;
 }
 
 } // anonymous namespace
-- 
cgit