[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                       |   33 +++++++----------
 2 files changed, 15 insertions(+), 18 deletions(-)

New commits:
commit fdc60b7497439e25a1b30d259f3407aeff8e3236
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 14 09:25:32 2015 +0100

    limit access to dx array to min of input len and len of array
    
    i.e. the sal_Int32 nDXLen = std::min<sal_Int32>(nLen, aOldDX.size()); line
    and its usage
    
    Change-Id: Ib0100d2de210a45b340c3a7de6c6dcf2a07443d0
    (cherry picked from commit 6d4f97b05b1bfe5aae395134b2dc35805c23b8c4)
    Reviewed-on: https://gerrit.libreoffice.org/17751
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Norbert Thiebaud <nthiebaud at gmail.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf
new file mode 100644
index 0000000..a522132
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 8b92f54..7f7bf81 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1425,7 +1425,7 @@ bool EnhWMFReader::ReadEnhWMF()
                     sal_Int32   nLeft, nTop, nRight, nBottom, ptlReferenceX, ptlReferenceY, nGfxMode, nXScale, nYScale;
                     sal_uInt32  nCurPos, nOffString, nOptions, offDx;
                     sal_Int32   nLen;
-                    long* pDX = NULL;
+                    std::vector<long> aDX;
 
                     nCurPos = pWMF->Tell() - 8;
 
@@ -1451,13 +1451,12 @@ bool EnhWMFReader::ReadEnhWMF()
                             pWMF->Seek( nCurPos + offDx );
                             if ( ( nLen * sizeof(sal_uInt32) ) <= ( nEndPos - pWMF->Tell() ) )
                             {
-                                pDX = new long[ nLen ];
-                                sal_Int32 i;
-                                sal_Int32 val;
-                                for ( i = 0; i < nLen; i++ )
+                                aDX.resize(nLen);
+                                for (sal_Int32 i = 0; i < nLen; ++i)
                                 {
-                                    pWMF->ReadInt32( val );
-                                    pDX[ i ] = val;
+                                    sal_Int32 val(0);
+                                    pWMF->ReadInt32(val);
+                                    aDX[i] = val;
                                 }
                             }
                         }
@@ -1469,23 +1468,22 @@ bool EnhWMFReader::ReadEnhWMF()
                             {
                                 boost::scoped_array<sal_Char> pBuf(new sal_Char[ nLen ]);
                                 pWMF->Read( pBuf.get(), nLen );
-                                aText = OUString( pBuf.get(), (sal_uInt16)nLen, pOut->GetCharSet() );
+                                aText = OUString(pBuf.get(), nLen, pOut->GetCharSet());
                                 pBuf.reset();
 
                                 if ( aText.getLength() != nLen )
                                 {
-                                    sal_uInt16 i, j;
-                                    long* pOldDx = pDX;
-                                    pDX = new long[ aText.getLength() ];
-                                    for ( i = 0, j = 0; i < aText.getLength(); i++ )
+                                    std::vector<long> aOldDX(aText.getLength());
+                                    aOldDX.swap(aDX);
+                                    sal_Int32 nDXLen = std::min<sal_Int32>(nLen, aOldDX.size());
+                                    for (sal_Int32 i = 0, j = 0; i < aText.getLength(); ++i)
                                     {
                                         sal_Unicode cUniChar = aText[i];
                                         OString aCharacter(&cUniChar, 1, pOut->GetCharSet());
-                                        pDX[ i ] = 0;
-                                        for (sal_Int32 k = 0; ( k < aCharacter.getLength() ) && ( j < nLen ) && ( i < aText.getLength() ); ++k)
-                                            pDX[ i ] += pOldDx[ j++ ];
+                                        aDX[i] = 0;
+                                        for (sal_Int32 k = 0; ( k < aCharacter.getLength() ) && ( j < nDXLen ) && ( i < aText.getLength() ); ++k)
+                                            aDX[ i ] += aOldDX[j++];
                                     }
-                                    delete[] pOldDx;
                                 }
                             }
                         }
@@ -1507,9 +1505,8 @@ bool EnhWMFReader::ReadEnhWMF()
                                 aText = OUString(pBuf.get(), nLen);
                             }
                         }
-                        pOut->DrawText( aPos, aText, pDX, bRecordPath, nGfxMode );
+                        pOut->DrawText(aPos, aText, aDX.data(), bRecordPath, nGfxMode);
                     }
-                    delete[] pDX;
                 }
                 break;