[Libreoffice-commits] .: binfilter/bf_svtools

[Caolán McNamara]

 binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx |    4 
 binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx   |   73 ++++++++++--
 2 files changed, 68 insertions(+), 9 deletions(-)

New commits:
commit de9acff682c036f7e0f24427098a14042371b155
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Aug 15 17:02:29 2012 +0100

    merge in various filter work from core
    
    Change-Id: I14ca1319e7e96941037450aee59d7a926d290c71

diff --git a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
index 511b1a2..5f3c5b8 100644
--- a/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/igif/svt_gifread.cxx
@@ -44,6 +44,10 @@ GIFReader::GIFReader( SvStream& rStm ) :
             nLastPos        ( rStm.Tell() ),
             nLogWidth100    ( 0UL ),
             nLogHeight100   ( 0UL ),
+            nGlobalWidth    ( 0 ),
+            nGlobalHeight   ( 0 ),
+            nImageWidth     ( 0 ),
+            nImageHeight    ( 0 ),
             nLoops          ( 1 ),
             eActAction      ( GLOBAL_HEADER_READING ),
             bGCTransparent  ( FALSE ),
diff --git a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
index d617a99..7934b87 100644
--- a/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
+++ b/binfilter/bf_svtools/source/filter.vcl/wmf/svt_winwmf.cxx
@@ -18,6 +18,7 @@
  */
 
 #include "winmtf.hxx"
+#include <boost/scoped_array.hpp>
 #include <rtl/crc.h>
 #include <rtl/tencinfo.h>
 #include <osl/endian.h>
@@ -320,28 +321,54 @@ void WMFReader::ReadRecordParams( USHORT nFunc )
 
         case W_META_POLYPOLYGON:
         {
-            USHORT  i, nPoly, nPoints;
-            USHORT* pnPoints;
+            bool bRecordOk = true;
+            USHORT  i, nPoly = 0, nPoints = 0;
             Point*  pPtAry;
             // Anzahl der Polygone:
             *pWMF >> nPoly;
             // Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-            pnPoints = new USHORT[ nPoly ];
-            nPoints = 0;
+            boost::scoped_array<USHORT> xPolygonPointCounts(new USHORT[nPoly]);
+            USHORT* pnPoints = xPolygonPointCounts.get();
             for( i = 0; i < nPoly; i++ )
             {
                 *pWMF >> pnPoints[i];
-                nPoints = nPoints + pnPoints[i];
+
+                if (pnPoints[i] > SAL_MAX_UINT16 - nPoints)
+                {
+                    bRecordOk = false;
+                    break;
+                }
+
+                nPoints += pnPoints[i];
             }
+
+            SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+            bRecordOk &= pWMF->good();
+
+            if (!bRecordOk)
+            {
+                pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                break;
+            }
+
             // Polygonpunkte holen:
-            pPtAry  = (Point*) new char[ nPoints * sizeof(Point) ];
+            boost::scoped_array<Point> xPolygonPoints(new Point[nPoints]);
+            pPtAry = xPolygonPoints.get();
             for ( i = 0; i < nPoints; i++ )
                 pPtAry[ i ] = ReadPoint();
+
+            bRecordOk &= pWMF->good();
+
+            if (!bRecordOk)
+            {
+                pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                break;
+            }
+
             // PolyPolygon Actions erzeugen
             PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
             pOut->DrawPolyPolygon( aPolyPoly );
-            delete[] (char*) pPtAry;
-            delete[] pnPoints;
         }
         break;
 
@@ -1171,16 +1198,44 @@ sal_Bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pSt
 
                 case W_META_POLYPOLYGON:
                 {
+                    bool bRecordOk = true;
                     USHORT  i, nPoly, nPoints = 0;
                     *pStm >> nPoly;
                     for( i = 0; i < nPoly; i++ )
                     {
-                        sal_uInt16 nP;
+                        sal_uInt16 nP = 0;
                         *pStm >> nP;
                         nPoints = nPoints + nP;
+                        if (nP > SAL_MAX_UINT16 - nPoints)
+                        {
+                            bRecordOk = false;
+                            break;
+                        }
+                        nPoints += nP;
                     }
+
+                    SAL_WARN_IF(!bRecordOk, "svtools", "polypolygon record has more polygons than we can handle");
+
+                    bRecordOk &= pStm->good();
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = sal_False;
+                        break;
+                    }
+
                     for ( i = 0; i < nPoints; i++ )
                         GetWinExtMax( ReadPoint(), rPlaceableBound, nMapMode );
+
+                    bRecordOk &= pStm->good();
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = sal_False;
+                        break;
+                    }
                 }
                 break;