[Libreoffice-commits] core.git: Branch 'libreoffice-5-4-7' - filter/source sd/qa

[Caolán McNamara]

 filter/source/graphicfilter/icgm/actimpr.cxx |    6 ++----
 filter/source/graphicfilter/icgm/class4.cxx  |   14 ++++++--------
 filter/source/graphicfilter/icgm/outact.hxx  |    2 +-
 sd/qa/unit/data/cgm/pass/binary_corvette.cgm |binary
 4 files changed, 9 insertions(+), 13 deletions(-)

New commits:
commit 6e81ed76f8db486d680734937c815d32e6934306
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Apr 16 10:16:56 2018 +0100

    Resolves: tdf#116999 fix reading cgm text at record bounds
    
    Change-Id: Ibbff7b0a3c3447135e0f6c585914dc6018e51765
    Reviewed-on: https://gerrit.libreoffice.org/52953
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 67d236252a743c77da4d929e95d5223454a47cd4)
    Reviewed-on: https://gerrit.libreoffice.org/53656
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Michael Stahl <Michael.Stahl at cib.de>

diff --git a/filter/source/graphicfilter/icgm/actimpr.cxx b/filter/source/graphicfilter/icgm/actimpr.cxx
index a2d844fb3723..3c5659fa6756 100644
--- a/filter/source/graphicfilter/icgm/actimpr.cxx
+++ b/filter/source/graphicfilter/icgm/actimpr.cxx
@@ -711,7 +711,7 @@ void CGMImpressOutAct::DrawPolyPolygon( tools::PolyPolygon& rPolyPolygon )
     }
 }
 
-void CGMImpressOutAct::DrawText( awt::Point& rTextPos, awt::Size& rTextSize, char* pString, FinalFlag eFlag )
+void CGMImpressOutAct::DrawText( awt::Point& rTextPos, awt::Size& rTextSize, const OUString& rString, FinalFlag eFlag )
 {
     if ( ImplCreateShape( "com.sun.star.drawing.TextShape" ) )
     {
@@ -800,8 +800,6 @@ void CGMImpressOutAct::DrawText( awt::Point& rTextPos, awt::Size& rTextSize, cha
         uno::Any aFirstQuery( maXShape->queryInterface( cppu::UnoType<text::XText>::get()));
         if( aFirstQuery >>= xText )
         {
-            OUString aStr(pString, rtl_str_getLength(pString), RTL_TEXTENCODING_ASCII_US);
-
             uno::Reference< text::XTextCursor >  aXTextCursor( xText->createTextCursor() );
             {
                 aXTextCursor->gotoEnd( false );
@@ -837,7 +835,7 @@ void CGMImpressOutAct::DrawText( awt::Point& rTextPos, awt::Size& rTextSize, cha
                             aAny <<= true;
                             maXPropSet->setPropertyValue( "TextFitToSize", aAny );
                         }
-                        aCursorText->setString( aStr );
+                        aCursorText->setString(rString);
                         aXTextCursor->gotoEnd( true );
                         ImplSetTextBundle( aCursorPropSet );
                     }
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index dc92f79cf560..a0b87dbff93e 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -186,15 +186,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI( 1 );
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[mnParaSize + nSize] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Size aSize;
                 awt::Point aPoint( (long)aFloatPoint.X, (long)aFloatPoint.Y );
-                mpOutAct->DrawText( aPoint, aSize,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, (FinalFlag)nType );
+                mpOutAct->DrawText(aPoint, aSize, aStr, (FinalFlag)nType);
                 mnParaSize = mnElementSize;
             }
             break;
@@ -224,15 +223,14 @@ void CGM::ImplDoClass4()
                 sal_uInt32 nType = ImplGetUI16();
                 sal_uInt32 nSize = ImplGetUI(1);
 
-                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize)
+                if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize)
                     throw css::uno::Exception("attempt to read past end of input", nullptr);
 
-                mpSource[ mnParaSize + nSize ] = 0;
+                OUString aStr(reinterpret_cast<char*>(mpSource) + mnParaSize, nSize, RTL_TEXTENCODING_ASCII_US);
 
                 awt::Point aPoint( (long)aFloatPoint.X, (long)aFloatPoint.Y );
                 awt::Size aSize((long)dx, (long)dy);
-                mpOutAct->DrawText( aPoint, aSize ,
-                                reinterpret_cast<char*>(mpSource) + mnParaSize, (FinalFlag)nType );
+                mpOutAct->DrawText(aPoint, aSize , aStr, (FinalFlag)nType);
                 mnParaSize = mnElementSize;
             }
             break;
diff --git a/filter/source/graphicfilter/icgm/outact.hxx b/filter/source/graphicfilter/icgm/outact.hxx
index badf8362b115..4b5d04f8d145 100644
--- a/filter/source/graphicfilter/icgm/outact.hxx
+++ b/filter/source/graphicfilter/icgm/outact.hxx
@@ -85,7 +85,7 @@ public:
     void                        DrawPolyLine( tools::Polygon& );
     void                        DrawPolybezier( tools::Polygon& );
     void                        DrawPolyPolygon( tools::PolyPolygon& );
-    void                        DrawText( css::awt::Point& TextRectPos, css::awt::Size& TextRectSize, char* String, FinalFlag );
+    void                        DrawText( css::awt::Point& TextRectPos, css::awt::Size& TextRectSize, const OUString& rString, FinalFlag );
     void                        AppendText( const char* String );
 
     void                        FirstOutPut() { mpCGM->mbFirstOutPut = false; } ;
diff --git a/sd/qa/unit/data/cgm/pass/binary_corvette.cgm b/sd/qa/unit/data/cgm/pass/binary_corvette.cgm
new file mode 100644
index 000000000000..2b38c48345d3
Binary files /dev/null and b/sd/qa/unit/data/cgm/pass/binary_corvette.cgm differ