[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - lotuswordpro/source

[Caolán McNamara]

 lotuswordpro/source/filter/lwpfilter.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit fb604dd5340ddb367f11ab53966cae1bd549863c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Mar 1 14:11:47 2017 +0000

    ofz: oom on seeks past end of SvMemoryStream
    
    cause it grows to fit if its a resizable stream
    
    Change-Id: I28b42becdfc8eb591d19d2512cdc1f1ec32c3bbe
    (cherry picked from commit a42d9c5b541d637dcf24086e30f341b30e03c4c7)
    Reviewed-on: https://gerrit.libreoffice.org/34753
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/lotuswordpro/source/filter/lwpfilter.cxx b/lotuswordpro/source/filter/lwpfilter.cxx
index 0389ee3..9a3bcfcd 100644
--- a/lotuswordpro/source/filter/lwpfilter.cxx
+++ b/lotuswordpro/source/filter/lwpfilter.cxx
@@ -104,7 +104,7 @@ using namespace OpenStormBento;
  bool Decompress(SvStream *pCompressed, SvStream * & pOutDecompressed)
 {
     pCompressed->Seek(0);
-    std::unique_ptr<SvStream> aDecompressed(new SvMemoryStream(4096, 4096));
+    std::unique_ptr<SvMemoryStream> aDecompressed(new SvMemoryStream(4096, 4096));
     unsigned char buffer[512];
     pCompressed->ReadBytes(buffer, 16);
     aDecompressed->WriteBytes(buffer, 16);
@@ -132,6 +132,9 @@ using namespace OpenStormBento;
     while (sal_uInt32 iRead = pCompressed->ReadBytes(buffer, 512))
         aDecompressed->WriteBytes(buffer, iRead);
 
+    // disable stream growing past its current size
+    aDecompressed->SetResizeOffset(0);
+
     //transfer ownership of aDecompressed's ptr
     pOutDecompressed = aDecompressed.release();
     return true;