<html>
<head>
<base href="https://bugs.documentfoundation.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_UNCONFIRMED "
title="UNCONFIRMED - Potential buffer overflow in PPTWriter::ImplWriteParagraphs"
href="https://bugs.documentfoundation.org/show_bug.cgi?id=121795">121795</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Potential buffer overflow in PPTWriter::ImplWriteParagraphs
</td>
</tr>
<tr>
<th>Product</th>
<td>LibreOffice
</td>
</tr>
<tr>
<th>Version</th>
<td>6.0.7.1 rc
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>UNCONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>Impress
</td>
</tr>
<tr>
<th>Assignee</th>
<td>libreoffice-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>eupharina@ispras.ru
</td>
</tr></table>
<p>
<div>
<pre>Description:
We've used our static analyzer Svace to check the Libreoffice source code
(version 6.0.7.1), both for benchmarking our analysis and for being helpful to
the open source community. We have found the following suspicious code snippet
(source locations are cited as in the current master):
In sd/source/filter/eppt/epptso.cxx there is PPTWriter::ImplWriteParagraphs
method on line 662. On lines 667-670, there is the following code:
nDepth = pPara->nDepth;
if ( nDepth > 4)
nDepth = 4;
This condition suggests that pPara->nDepth may be greater than 4, yet later in
the code when calling mpStyleSheet->IsHardAttribute at lines 714, 718, 721,
724, pPara->nDepth is used as nLevel parameter. Then inside IsHardAttribute the
nLevel variable is used as the index for the maParaLevel array of size 5 in
line 414 of pptx-stylesheet.cxx:
const PPTExParaLevel& rPara = mpParaSheet[ nInstance ]->maParaLevel[ nLevel ];
and then rPara is dereferenced inside the switch operator.
It seems that nDepth should be used instead of pPara->nDepth as in the similar
calls to IsHardAttribute at lines 730, 745 and others.
We would like to know if such bug reports are useful for you and whether this
is the right place to file them.
Steps to Reproduce:
Found the suspicious source code as a result of running static analysis over
it.
Actual Results:
Inconsistencies in using nDepth and pPara->nDepth in the cited code.
Expected Results:
Consistently use nDepth instead.
Reproducible: Didn't try
User Profile Reset: No
Additional Info:</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>