[Libreoffice-commits] core.git: Branch 'aoo/trunk' - 3 commits - rsc/source sal/osl sfx2/source

[Pedro Giffuni]

 rsc/source/rscpp/cpp1.c      |    2 +-
 sal/osl/unx/profile.c        |    2 +-
 sfx2/source/appl/sfxhelp.cxx |    3 +++
 3 files changed, 5 insertions(+), 2 deletions(-)

New commits:
commit cb7f2453763ffe5b3995227bb864deb8b7b14cba
Author: Pedro Giffuni <pfg at apache.org>
Date:   Mon Nov 30 01:11:23 2015 +0000

    Unbounded source buffer
    
    CID:	706163

diff --git a/rsc/source/rscpp/cpp1.c b/rsc/source/rscpp/cpp1.c
index eecfa27..b1aff3f 100644
--- a/rsc/source/rscpp/cpp1.c
+++ b/rsc/source/rscpp/cpp1.c
@@ -329,7 +329,7 @@ nRunde++;
                     cerror("Can't open input file \"%s\"", useargv[1]);
                     exit(IO_ERROR);
                 }
-                strcpy(work, useargv[1]);  /* Remember input filename      */
+                strncpy(work, useargv[1], sizeof(work));  /* Remember input filename      */
                 break;
             }                           /* Else, just get stdin         */
         case 0:                         /* No args?                     */
commit 557a4f2916e511fbd49025eded878b0bd9dc3500
Author: Pedro Giffuni <pfg at apache.org>
Date:   Mon Nov 30 00:51:32 2015 +0000

    Destination buffer too small
    
    CID:	706154

diff --git a/sal/osl/unx/profile.c b/sal/osl/unx/profile.c
index 6fb8d49..cb13b59 100644
--- a/sal/osl/unx/profile.c
+++ b/sal/osl/unx/profile.c
@@ -2064,7 +2064,7 @@ static sal_Bool osl_ProfileSwapProfileNames(osl_TProfileImpl* pProfile)
 
       osl_ProfileGenerateExtension(pProfile->m_FileName,"bak",pszBakFile);
 
-    strcpy(pszIniFile,pProfile->m_FileName);
+    strncpy(pszIniFile,pProfile->m_FileName,PATH_MAX);
 
     osl_ProfileGenerateExtension(pProfile->m_FileName,"tmp",pszTmpFile);
 
commit 62ded0e4d32f2b958dc4f609bfb2969f834cb86b
Author: Pedro Giffuni <pfg at apache.org>
Date:   Mon Nov 30 00:13:18 2015 +0000

    Use after free
    
    CID:	441015

diff --git a/sfx2/source/appl/sfxhelp.cxx b/sfx2/source/appl/sfxhelp.cxx
index 13af653..54631ea 100644
--- a/sfx2/source/appl/sfxhelp.cxx
+++ b/sfx2/source/appl/sfxhelp.cxx
@@ -846,7 +846,10 @@ SfxHelpWindow_Impl* impl_createHelp(Reference< XFrame >& rHelpTask   ,
     }
 
     if (!xHelpContent.is())
+    {
         delete pHelpWindow;
+        return NULL;
+    }
 
     xHelpContent->setName(::rtl::OUString(DEFINE_CONST_UNICODE("OFFICE_HELP")));