[Libreoffice-commits] .: Branch 'libreoffice-3-4' - editeng/source

[Kohei Yoshida]

 editeng/source/editeng/impedit2.cxx |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

New commits:
commit fd0c48dd0909c4151de5c23f1505535307943dc1
Author: Eike Rathke <erack at erack.de>
Date:   Sat Aug 6 01:39:24 2011 +0200

    fdo#39869 Fix memory exhaustion with String length of STRLEN_MAX
    
    Signed-off-by: Kohei Yoshida <kohei.yoshida at suse.com>

diff --git a/editeng/source/editeng/impedit2.cxx b/editeng/source/editeng/impedit2.cxx
index cb9497e..0a0760f 100644
--- a/editeng/source/editeng/impedit2.cxx
+++ b/editeng/source/editeng/impedit2.cxx
@@ -2708,21 +2708,23 @@ EditPaM ImpEditEngine::ImpInsertText( EditSelection aCurSel, const XubString& rS
     // Token LINE_SEP query,
     // since the MAC-Compiler makes something else from \n !
 
-    sal_uInt16 nStart = 0;
+    // fdo#39869 The loop run variable must be capable to hold STRLEN_MAX+1, 
+    // that with STRING32 would be SAL_MAX_INT32+1 but with 16-bit is 0xFFFF+1
+    sal_uInt32 nStart = 0;
     while ( nStart < aText.Len() )
     {
-        sal_uInt16 nEnd = aText.Search( LINE_SEP, nStart );
+        sal_uInt32 nEnd = aText.Search( LINE_SEP, static_cast<xub_StrLen>(nStart) );
         if ( nEnd == STRING_NOTFOUND )
             nEnd = aText.Len();	// not dereference!
 
         // Start == End => empty line
         if ( nEnd > nStart )
         {
-            XubString aLine( aText, nStart, nEnd-nStart );
+            XubString aLine( aText, nStart, static_cast<xub_StrLen>(nEnd-nStart) );
             xub_StrLen nChars = aPaM.GetNode()->Len() + aLine.Len();
             if ( nChars > MAXCHARSINPARA )
             {
-                sal_uInt16 nMaxNewChars = MAXCHARSINPARA-aPaM.GetNode()->Len();
+                xub_StrLen nMaxNewChars = MAXCHARSINPARA-aPaM.GetNode()->Len();
                 nEnd -= ( aLine.Len() - nMaxNewChars );	// Then the characters end up in the next paragraph.
                 aLine.Erase( nMaxNewChars );            // Delete the Rest...
             }
@@ -2733,15 +2735,17 @@ EditPaM ImpEditEngine::ImpInsertText( EditSelection aCurSel, const XubString& rS
                 aPaM = aEditDoc.InsertText( aPaM, aLine );
             else
             {
-                sal_uInt16 nStart2 = 0;
+                sal_uInt32 nStart2 = 0;
                 while ( nStart2 < aLine.Len() )
                 {
-                    sal_uInt16 nEnd2 = aLine.Search( '\t', nStart2 );
+                    sal_uInt32 nEnd2 = aLine.Search( '\t', static_cast<xub_StrLen>(nStart2) );
                     if ( nEnd2 == STRING_NOTFOUND )
                         nEnd2 = aLine.Len();	// not dereference!
 
                     if ( nEnd2 > nStart2 )
-                        aPaM = aEditDoc.InsertText( aPaM, XubString( aLine, nStart2, nEnd2-nStart2 ) );
+                        aPaM = aEditDoc.InsertText( aPaM, XubString( aLine, 
+                                    static_cast<xub_StrLen>(nStart2), 
+                                    static_cast<xub_StrLen>(nEnd2-nStart2) ) );
                     if ( nEnd2 < aLine.Len() )
                     {
                         aPaM = aEditDoc.InsertFeature( aPaM, aTabItem );