[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - connectivity/source

[Caolán McNamara]

 connectivity/source/drivers/dbase/DTable.cxx |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

New commits:
commit c80754dac761b8489250c1ede510fb76b98cc590
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 18 12:07:27 2014 +0100

    check len before memcpying into it
    
    valgrind + bff on sf_3e0068c9b19bb548826bed0599f65745-CrdWMI-minimized.gif
    
    Change-Id: I74cc21609f1c97a27e13615593f678cbbc8463e3
    (cherry picked from commit d4e64d030092984077021a9af9d281cd64c476bf)
    Reviewed-on: https://gerrit.libreoffice.org/10991
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx
index 9dd02ba..6036194 100644
--- a/connectivity/source/drivers/dbase/DTable.cxx
+++ b/connectivity/source/drivers/dbase/DTable.cxx
@@ -799,6 +799,7 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
             (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_PRECISION)) >>= nLen;
             (*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_TYPE))      >>= nType;
         }
+
         switch(nType)
         {
             case DataType::INTEGER:
@@ -875,6 +876,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
         else if ( DataType::INTEGER == nType )
         {
             sal_Int32 nValue = 0;
+            if (static_cast<size_t>(nLen) > sizeof(nValue))
+                return false;
             memcpy(&nValue, pData, nLen);
             *(_rRow->get())[i] = nValue;
         }
@@ -884,6 +887,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
             if (getBOOL((*aIter)->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately
             {
                 sal_Int64 nValue = 0;
+                if (static_cast<size_t>(nLen) > sizeof(nValue))
+                    return false;
                 memcpy(&nValue, pData, nLen);
 
                 if ( m_aScales[i-1] )
@@ -893,6 +898,8 @@ bool ODbaseTable::fetchRow(OValueRefRow& _rRow, const OSQLColumns & _rCols, bool
             }
             else
             {
+                if (static_cast<size_t>(nLen) > sizeof(d))
+                    return false;
                 memcpy(&d, pData, nLen);
             }
 
@@ -1852,6 +1859,8 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons
                 case DataType::INTEGER:
                     {
                         sal_Int32 nValue = thisColVal;
+                        if (static_cast<size_t>(nLen) > sizeof(nValue))
+                            return false;
                         memcpy(pData,&nValue,nLen);
                     }
                     break;
@@ -1867,10 +1876,16 @@ bool ODbaseTable::UpdateBuffer(OValueRefVector& rRow, OValueRefRow pOrgRow, cons
                                 nValue = (sal_Int64)(d * pow(10.0,(int)m_aScales[i]));
                             else
                                 nValue = (sal_Int64)(d);
+                            if (static_cast<size_t>(nLen) > sizeof(nValue))
+                                return false;
                             memcpy(pData,&nValue,nLen);
                         } // if (getBOOL(xCol->getPropertyValue(OMetaConnection::getPropMap().getNameByIndex(PROPERTY_ID_ISCURRENCY)))) // Currency is treated separately
                         else
+                        {
+                            if (static_cast<size_t>(nLen) > sizeof(d))
+                                return false;
                             memcpy(pData,&d,nLen);
+                        }
                     }
                     break;
                 case DataType::DECIMAL: