[Libreoffice-commits] core.git: 2 commits - filter/source svtools/source

[Caolán McNamara]

 filter/source/graphicfilter/ieps/ieps.cxx |   24 +++++++++++-------------
 svtools/source/graphic/grfmgr2.cxx        |   18 +++++++-----------
 2 files changed, 18 insertions(+), 24 deletions(-)

New commits:
commit d1f31681623696e99b0bd9e98570cb1ebac518cc
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 27 08:58:51 2017 +0000

    ofz: check if the stream is able to meet the eps len claim before reading
    
    Change-Id: I440c7f38d6588c570a411f2a97c0164e5d7d646f

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index 090bc65..2a8f900 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -399,6 +399,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r
         return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic);
 }
 
+namespace
+{
+    bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
+    {
+        const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+        return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
+    }
+}
+
 // this method adds a replacement action containing the original wmf or tiff replacement,
 // so the original eps can be written when storing to ODF.
 void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize,
@@ -416,17 +425,15 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32
         aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize )
                     .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF )
                     .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF );
-        if ( nSizeWMF )
+        if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF)
         {
             std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]);
-            rStrm.Seek( nOrigPos + nPosWMF );
             rStrm.ReadBytes(pBuf.get(), nSizeWMF);
             aReplacement.WriteBytes(pBuf.get(), nSizeWMF);
         }
-        if ( nSizeTIFF )
+        if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF)
         {
             std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]);
-            rStrm.Seek( nOrigPos + nPosTIFF );
             rStrm.ReadBytes(pBuf.get(), nSizeTIFF);
             aReplacement.WriteBytes(pBuf.get(), nSizeTIFF);
         }
@@ -519,15 +526,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
     rGraphic = aMtf;
 }
 
-namespace
-{
-    bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
-    {
-        const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
-        return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
-    }
-}
-
 //================== GraphicImport - the exported function ================
 
 
commit b602313ab871da31da4ca3a25cc2f84c12efb65e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 26 21:29:59 2017 +0000

    tweak the scoping here a little
    
    Change-Id: Idb257e3aee7d3f0316f34d34866eb2484390a798

diff --git a/svtools/source/graphic/grfmgr2.cxx b/svtools/source/graphic/grfmgr2.cxx
index f71c67a..7ef820e 100644
--- a/svtools/source/graphic/grfmgr2.cxx
+++ b/svtools/source/graphic/grfmgr2.cxx
@@ -1723,10 +1723,6 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent
     // been generated
     ImplTileInfo aTileInfo;
 
-    // current output position while drawing
-    Point aCurrPos;
-    int nX, nY;
-
     // check for recursion's end condition: LSB place reached?
     if( nMSBFactor == 1 )
     {
@@ -1768,9 +1764,9 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent
         {
             // now fill one row from aTileInfo.aNextTileTopLeft.X() all
             // the way to the right
-            aCurrPos.X() = aTileInfo.aNextTileTopLeft.X();
-            aCurrPos.Y() = aTileInfo.aTileTopLeft.Y();
-            for( nX=0; nX < aTileInfo.nTilesEmptyX; nX += nMSBFactor )
+            // current output position while drawing
+            Point aCurrPos(aTileInfo.aNextTileTopLeft.X(), aTileInfo.aTileTopLeft.Y());
+            for (int nX=0; nX < aTileInfo.nTilesEmptyX; nX += nMSBFactor)
             {
                 if( !aTmpGraphic.Draw( &rVDev, aCurrPos, aTileInfo.aTileSizePixel, pAttr, nFlags ) )
                     return false;
@@ -1791,7 +1787,7 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent
             // the way to the bottom
             aCurrPos.X() = aTileInfo.aTileTopLeft.X();
             aCurrPos.Y() = aTileInfo.aNextTileTopLeft.Y();
-            for( nY=0; nY < aTileInfo.nTilesEmptyY; nY += nMSBFactor )
+            for (int nY=0; nY < aTileInfo.nTilesEmptyY; nY += nMSBFactor)
             {
                 if( !aTmpGraphic.Draw( &rVDev, aCurrPos, aTileInfo.aTileSizePixel, pAttr, nFlags ) )
                     return false;
@@ -1838,18 +1834,18 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent
     rTileInfo.nTilesEmptyY     = aTileInfo.nTilesEmptyY - nRemainderTilesY;
 
     // init output position
-    aCurrPos = aTileInfo.aNextTileTopLeft;
+    Point aCurrPos = aTileInfo.aNextTileTopLeft;
 
     // fill our drawing area. Fill possibly more, to create the next
     // bigger tile size -> see bitmap extraction above. This does no
     // harm, since everything right or below our actual area is
     // overdrawn by our caller. Just in case we're in the last level,
     // we don't draw beyond the right or bottom border.
-    for( nY=0; nY < aTileInfo.nTilesEmptyY && nY < nExponent*nMSBFactor; nY += nMSBFactor )
+    for (int nY=0; nY < aTileInfo.nTilesEmptyY && nY < nExponent*nMSBFactor; nY += nMSBFactor)
     {
         aCurrPos.X() = aTileInfo.aNextTileTopLeft.X();
 
-        for( nX=0; nX < aTileInfo.nTilesEmptyX && nX < nExponent*nMSBFactor; nX += nMSBFactor )
+        for (int nX=0; nX < aTileInfo.nTilesEmptyX && nX < nExponent*nMSBFactor; nX += nMSBFactor)
         {
             if( bNoFirstTileDraw )
                 bNoFirstTileDraw = false; // don't draw first tile position