[Libreoffice-commits] core.git: vcl/qa vcl/source

[Libreoffice Gerrit user]

 vcl/qa/cppunit/pdfexport/data/forcepoint71.key |binary
 vcl/qa/cppunit/pdfexport/pdfexport.cxx         |   16 +++++++++++++++-
 vcl/source/gdi/pdfwriter_impl.cxx              |   12 ++++++++++--
 3 files changed, 25 insertions(+), 3 deletions(-)

New commits:
commit 83b25e4b9fa8f95c24759a64f8cb9716ee34a4a3
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 3 10:57:42 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Aug 3 20:41:27 2018 +0200

    forcepoint#71 sanity check when copying pieces of imported pdf
    
    Change-Id: I7e340e15c95cdfa8b185f61fad7e14bd00babf21
    Reviewed-on: https://gerrit.libreoffice.org/58555
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/pdfexport/data/forcepoint71.key b/vcl/qa/cppunit/pdfexport/data/forcepoint71.key
new file mode 100644
index 000000000000..716fe58480a0
Binary files /dev/null and b/vcl/qa/cppunit/pdfexport/data/forcepoint71.key differ
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 53135e61b2f6..edcd95af9281 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -47,6 +47,7 @@ public:
     PdfExportTest();
     virtual void setUp() override;
     virtual void tearDown() override;
+    void topdf(const OUString& rFile);
     void load(const OUString& rFile, vcl::filter::PDFDocument& rDocument);
     /// Tests that a pdf image is roundtripped back to PDF as a vector format.
     void testTdf106059();
@@ -59,6 +60,7 @@ public:
     void testTdf106206();
     /// Tests export of PDF images without reference XObjects.
     void testTdf106693();
+    void testForcePoint71();
     void testTdf106972();
     void testTdf106972Pdf17();
     void testTdf107013();
@@ -95,6 +97,7 @@ public:
     CPPUNIT_TEST(testTdf105093);
     CPPUNIT_TEST(testTdf106206);
     CPPUNIT_TEST(testTdf106693);
+    CPPUNIT_TEST(testForcePoint71);
     CPPUNIT_TEST(testTdf106972);
     CPPUNIT_TEST(testTdf106972Pdf17);
     CPPUNIT_TEST(testTdf107013);
@@ -170,7 +173,7 @@ void PdfExportTest::tearDown()
 
 char const DATA_DIRECTORY[] = "/vcl/qa/cppunit/pdfexport/data/";
 
-void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocument)
+void PdfExportTest::topdf(const OUString& rFile)
 {
     // Import the bugdoc and export as PDF.
     OUString aURL = m_directories.getURLFromSrc(DATA_DIRECTORY) + rFile;
@@ -181,6 +184,11 @@ void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocum
     utl::MediaDescriptor aMediaDescriptor;
     aMediaDescriptor["FilterName"] <<= OUString("writer_pdf_Export");
     xStorable->storeToURL(maTempFile.GetURL(), aMediaDescriptor.getAsConstPropertyValueList());
+}
+
+void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocument)
+{
+    topdf(rFile);
 
     // Parse the export result.
     SvFileStream aStream(maTempFile.GetURL(), StreamMode::READ);
@@ -1450,6 +1458,12 @@ void PdfExportTest::testTdf113143()
     CPPUNIT_ASSERT_LESS(nLarger, nSmaller);
 }
 
+void PdfExportTest::testForcePoint71()
+{
+    // I just care it doesn't crash
+    topdf("forcepoint71.key");
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(PdfExportTest);
 
 }
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx b/vcl/source/gdi/pdfwriter_impl.cxx
index 7fd72ab9a671..91dcd3515e37 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -9023,7 +9023,11 @@ sal_Int32 PDFWriterImpl::copyExternalResource(SvMemoryStream& rDocBuffer, filter
         {
             // Copy the last part here, in the complex case.
             sal_uInt64 nDictEnd = rObject.GetDictionaryOffset() + rObject.GetDictionaryLength();
-            aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nDictEnd - nCopyStart);
+            const sal_Int32 nLen = nDictEnd - nCopyStart;
+            if (nLen < 0)
+                SAL_WARN("vcl.pdfwriter", "copyExternalResource() failed");
+            else
+                aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nLen);
         }
         else
             // Can copy it as-is.
@@ -9086,7 +9090,11 @@ sal_Int32 PDFWriterImpl::copyExternalResource(SvMemoryStream& rDocBuffer, filter
         {
             // Copy the last part here, in the complex case.
             sal_uInt64 nArrEnd = rObject.GetArrayOffset() + rObject.GetArrayLength();
-            aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nArrEnd - nCopyStart);
+            const sal_Int32 nLen = nArrEnd - nCopyStart;
+            if (nLen < 0)
+                SAL_WARN("vcl.pdfwriter", "copyExternalResource() failed");
+            else
+                aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nLen);
         }
         else
             // Can copy it as-is.