[Libreoffice-commits] core.git: 2 commits - filter/source include/filter sc/source

[Andras Timar]

 filter/source/msfilter/msdffimp.cxx  |   17 ++++-------------
 include/filter/msfilter/msdffimp.hxx |    2 --
 sc/source/filter/excel/xiescher.cxx  |    5 -----
 sc/source/filter/inc/xiescher.hxx    |    2 --
 4 files changed, 4 insertions(+), 22 deletions(-)

New commits:
commit 5b940edaf66ab8371192ef67ef9171c0d40f7e18
Author: Andras Timar <andras.timar at collabora.com>
Date:   Thu Nov 27 23:04:25 2014 +0100

    unused function Calc_nBLIPPos
    
    Change-Id: Iaa4073e2f1c0ccea7a5d63d24e34ac5647a0e7b0

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index d1ca581..22eda40 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5863,10 +5863,6 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
                 if( (!nBLIPPos) && (nBLIPLen < nLenFBSE) )
                     nBLIPPos = rSt.Tell() + 4;
 
-                // That worked great!
-                // We store, that we do have one FBSE more in the pointer array.
-                nBLIPPos = Calc_nBLIPPos(nBLIPPos, rSt.Tell());
-
                 if( USHRT_MAX == nBLIPCount )
                     nBLIPCount = 1;
                 else
@@ -6485,11 +6481,6 @@ void SvxMSDffManager::ProcessClientAnchor2( SvStream& /* rSt */, DffRecordHeader
     return;  // will be overloaded by SJ in Draw
 }
 
-sal_uLong SvxMSDffManager::Calc_nBLIPPos( sal_uLong nOrgVal, sal_uLong /* nStreamPos */ ) const
-{
-    return nOrgVal;
-}
-
 bool SvxMSDffManager::GetOLEStorageName( long /* nOLEId */, OUString&, SvStorageRef&, uno::Reference < embed::XStorage >& ) const
 {
     return false;
diff --git a/include/filter/msfilter/msdffimp.hxx b/include/filter/msfilter/msdffimp.hxx
index 4523462..f129ec8 100644
--- a/include/filter/msfilter/msdffimp.hxx
+++ b/include/filter/msfilter/msdffimp.hxx
@@ -504,8 +504,6 @@ protected :
                                    void* pData,
                                    Rectangle& rTextRect,
                                    SdrObject* pObj = NULL);
-    virtual sal_uLong Calc_nBLIPPos( sal_uLong nOrgVal,
-                                     sal_uLong nStreamPos ) const;
     virtual bool GetColorFromPalette(sal_uInt16 nNum, Color& rColor) const;
 
     // Fontwork objects use a new implementation of ReadObjText because the old
diff --git a/sc/source/filter/excel/xiescher.cxx b/sc/source/filter/excel/xiescher.cxx
index bc25d5a..3da59ae 100644
--- a/sc/source/filter/excel/xiescher.cxx
+++ b/sc/source/filter/excel/xiescher.cxx
@@ -3534,11 +3534,6 @@ SdrObject* XclImpDffConverter::ProcessObj( SvStream& rDffStrm, DffObjData& rDffO
     return xSdrObj.release();
 }
 
-sal_uLong XclImpDffConverter::Calc_nBLIPPos( sal_uLong /*nOrgVal*/, sal_uLong nStreamPos ) const
-{
-    return nStreamPos + 4;
-}
-
 bool XclImpDffConverter::InsertControl( const Reference< XFormComponent >& rxFormComp,
         const ::com::sun::star::awt::Size& /*rSize*/, Reference< XShape >* pxShape,
         bool /*bFloatingCtrl*/ )
diff --git a/sc/source/filter/inc/xiescher.hxx b/sc/source/filter/inc/xiescher.hxx
index 0a936ef..dc2be34 100644
--- a/sc/source/filter/inc/xiescher.hxx
+++ b/sc/source/filter/inc/xiescher.hxx
@@ -977,8 +977,6 @@ private:
                             void* pClientData,
                             Rectangle& rTextRect,
                             SdrObject* pOldSdrObj = 0 ) SAL_OVERRIDE;
-    /** Returns the BLIP stream position, based on the passed DFF stream position. */
-    virtual sal_uLong       Calc_nBLIPPos( sal_uLong nOrgVal, sal_uLong nStreamPos ) const SAL_OVERRIDE;
 
     // virtual functions of SvxMSConvertOCXControls
 
commit 6945971c79d70d77c5c8bb6593b3f25ef46b0887
Author: Andras Timar <andras.timar at collabora.com>
Date:   Thu Nov 27 20:56:32 2014 +0100

    fdo#84686 prevent std::bad_alloc exception by stricter input check
    
    The bugdoc has invalid length (rh.recLen) in header of blipStore's
    OfficeArtFBSE record. Therefore LibreOffice read junk for the next
    BLIP, and tried to seek to an invalid stream position, which caused
    bad allocation exception on 32-bit systems.
    
    Change-Id: I72fae4c2b00216b57736f4409a32c62a40f25785

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 0defb0a..d1ca581 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5798,8 +5798,7 @@ void SvxMSDffManager::GetCtrlData( sal_uInt32 nOffsDgg_ )
 }
 
 
-// from here on: Drawing Group Container  i.e. Ddocument-wide valid data
-//                      =======================           ========
+// from here on: Drawing Group Container  i.e. document-wide valid data
 
 void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLenDgg )
 {
@@ -5839,7 +5838,7 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
     {
         if(!ReadCommonRecordHeader( rSt, nVer, nInst, nFbt, nLength)) return;
         nRead += DFF_COMMON_RECORD_HEADER_SIZE + nLength;
-        if( DFF_msofbtBSE == nFbt )
+        if( DFF_msofbtBSE == nFbt && /* magic value from spec */ 0x2 == nVer )
         {
             nLenFBSE = nLength;
             // is FBSE big enough for our data
@@ -5876,8 +5875,9 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
                 // now save the info for later access
                 pBLIPInfos->push_back( new SvxMSDffBLIPInfo( nInst, nBLIPPos, nBLIPLen ) );
             }
+            rSt.SeekRel( nLength );
         }
-        rSt.SeekRel( nLength );
+        else return; // invalid input
     }
     while( nRead < nLenBStoreCont );
 }