[Libreoffice-commits] core.git: editeng/source include/svtools svtools/source

[Caolán McNamara]

 editeng/source/rtf/svxrtf.cxx     |    6 +++++-
 include/svtools/svparser.hxx      |    1 +
 svtools/source/svrtf/parrtf.cxx   |    8 +++++++-
 svtools/source/svrtf/svparser.cxx |    5 +++++
 4 files changed, 18 insertions(+), 2 deletions(-)

New commits:
commit e4551b905e12aa92b7509d9b994bfae5dec3d8e0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Nov 6 12:57:57 2017 +0000

    ofz infinite loop
    
    Change-Id: Iae9faaa86e4b3edb9a1fdfe9c6b67eee211c19a9
    Reviewed-on: https://gerrit.libreoffice.org/44361
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index f84a30ff026c..568abc078757 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -294,8 +294,11 @@ void SvxRTFParser::ReadStyleTable()
     bIsInReadStyleTab = true;
     bChkStyleAttr = false;      // Do not check Attribute against the Styles
 
-    while( _nOpenBrakets && IsParserWorking() )
+    bool bLooping = false;
+
+    while (_nOpenBrakets && IsParserWorking() && !bLooping)
     {
+        auto nCurrentTokenIndex = m_nTokenIndex;
         int nToken = GetNextToken();
         switch( nToken )
         {
@@ -378,6 +381,7 @@ void SvxRTFParser::ReadStyleTable()
             }
             break;
         }
+        bLooping = nCurrentTokenIndex == m_nTokenIndex;
     }
     pStyle.reset();         // Delete the Last Style
     SkipToken();        // the closing brace is evaluated "above"
diff --git a/include/svtools/svparser.hxx b/include/svtools/svparser.hxx
index 5ab0df9fca01..2d3eaeeaf254 100644
--- a/include/svtools/svparser.hxx
+++ b/include/svtools/svparser.hxx
@@ -54,6 +54,7 @@ protected:
     sal_uLong           nlLinePos;          // current column number
 
     std::unique_ptr<SvParser_Impl<T>> pImplData; // internal data
+    long                m_nTokenIndex;      // current token index to detect loops for seeking backwards
     long                nTokenValue;        // additional value (RTF)
     bool                bTokenHasValue;     // indicates whether nTokenValue is valid
     SvParserState       eState;             // status also in derived classes
diff --git a/svtools/source/svrtf/parrtf.cxx b/svtools/source/svrtf/parrtf.cxx
index cd2b4537c0dc..bcdb67b4600e 100644
--- a/svtools/source/svrtf/parrtf.cxx
+++ b/svtools/source/svrtf/parrtf.cxx
@@ -600,8 +600,12 @@ void SvRTFParser::Continue( int nToken )
     if( !nToken )
         nToken = GetNextToken();
 
-    while( IsParserWorking() )
+    bool bLooping = false;
+
+    while (IsParserWorking() && !bLooping)
     {
+        auto nCurrentTokenIndex = m_nTokenIndex;
+
         SaveState( nToken );
         switch( nToken )
         {
@@ -658,6 +662,8 @@ NEXTTOKEN:
             SaveState( 0 );         // processed till here,
                                     // continue with new token!
         nToken = GetNextToken();
+
+        bLooping = nCurrentTokenIndex == m_nTokenIndex;
     }
     if( SvParserState::Accepted == eState && 0 < nOpenBrakets )
         eState = SvParserState::Error;
diff --git a/svtools/source/svrtf/svparser.cxx b/svtools/source/svrtf/svparser.cxx
index 2d1be0e3e405..bfcc511a8490 100644
--- a/svtools/source/svrtf/svparser.cxx
+++ b/svtools/source/svrtf/svparser.cxx
@@ -76,6 +76,7 @@ SvParser<T>::SvParser( SvStream& rIn, sal_uInt8 nStackSize )
     , nlLineNr( 1 )
     , nlLinePos( 1 )
     , pImplData( nullptr )
+    , m_nTokenIndex(0)
     , nTokenValue( 0 )
     , bTokenHasValue( false )
     , eState( SvParserState::NotStarted )
@@ -476,6 +477,7 @@ T SvParser<T>::GetNextToken()
         bTokenHasValue = pTokenStackPos->bTokenHasValue;
         aToken = pTokenStackPos->sToken;
         nRet = pTokenStackPos->nTokenId;
+        ++m_nTokenIndex;
     }
     // no, now push actual value on stack
     else if( SvParserState::Working == eState )
@@ -484,6 +486,7 @@ T SvParser<T>::GetNextToken()
         pTokenStackPos->nTokenValue = nTokenValue;
         pTokenStackPos->bTokenHasValue = bTokenHasValue;
         pTokenStackPos->nTokenId = nRet;
+        ++m_nTokenIndex;
     }
     else if( SvParserState::Accepted != eState && SvParserState::Pending != eState )
         eState = SvParserState::Error;       // an error occurred
@@ -502,6 +505,8 @@ T SvParser<T>::SkipToken( short nCnt )       // "skip" n Tokens backward
         nTmp = nTokenStackSize;
     nTokenStackPos = sal_uInt8(nTmp);
 
+    m_nTokenIndex -= nTmp;
+
     // restore values
     aToken = pTokenStackPos->sToken;
     nTokenValue = pTokenStackPos->nTokenValue;