[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - vcl/qa vcl/source

[Libreoffice Gerrit user]

 vcl/qa/cppunit/pdfexport/data/forcepoint71.key |binary
 vcl/qa/cppunit/pdfexport/pdfexport.cxx         |   16 +++++++++++++++-
 vcl/source/gdi/pdfwriter_impl.cxx              |   12 ++++++++++--
 3 files changed, 25 insertions(+), 3 deletions(-)

New commits:
commit b900b6ef5651273c8c9a23f388c03e6530870a81
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 3 10:57:42 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 7 17:42:32 2018 +0200

    forcepoint#71 sanity check when copying pieces of imported pdf
    
    Change-Id: I7e340e15c95cdfa8b185f61fad7e14bd00babf21
    Reviewed-on: https://gerrit.libreoffice.org/58579
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>

diff --git a/vcl/qa/cppunit/pdfexport/data/forcepoint71.key b/vcl/qa/cppunit/pdfexport/data/forcepoint71.key
new file mode 100644
index 000000000000..716fe58480a0
Binary files /dev/null and b/vcl/qa/cppunit/pdfexport/data/forcepoint71.key differ
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 5d8214b898c3..78cec0a881d7 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -48,6 +48,7 @@ public:
     PdfExportTest();
     virtual void setUp() override;
     virtual void tearDown() override;
+    void topdf(const OUString& rFile);
     void load(const OUString& rFile, vcl::filter::PDFDocument& rDocument);
     /// Tests that a pdf image is roundtripped back to PDF as a vector format.
     void testTdf106059();
@@ -60,6 +61,7 @@ public:
     void testTdf106206();
     /// Tests export of PDF images without reference XObjects.
     void testTdf106693();
+    void testForcePoint71();
     void testTdf106972();
     void testTdf106972Pdf17();
     void testTdf107013();
@@ -96,6 +98,7 @@ public:
     CPPUNIT_TEST(testTdf105093);
     CPPUNIT_TEST(testTdf106206);
     CPPUNIT_TEST(testTdf106693);
+    CPPUNIT_TEST(testForcePoint71);
     CPPUNIT_TEST(testTdf106972);
     CPPUNIT_TEST(testTdf106972Pdf17);
     CPPUNIT_TEST(testTdf107013);
@@ -171,7 +174,7 @@ void PdfExportTest::tearDown()
 
 char const DATA_DIRECTORY[] = "/vcl/qa/cppunit/pdfexport/data/";
 
-void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocument)
+void PdfExportTest::topdf(const OUString& rFile)
 {
     // Import the bugdoc and export as PDF.
     OUString aURL = m_directories.getURLFromSrc(DATA_DIRECTORY) + rFile;
@@ -182,6 +185,11 @@ void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocum
     utl::MediaDescriptor aMediaDescriptor;
     aMediaDescriptor["FilterName"] <<= OUString("writer_pdf_Export");
     xStorable->storeToURL(maTempFile.GetURL(), aMediaDescriptor.getAsConstPropertyValueList());
+}
+
+void PdfExportTest::load(const OUString& rFile, vcl::filter::PDFDocument& rDocument)
+{
+    topdf(rFile);
 
     // Parse the export result.
     SvFileStream aStream(maTempFile.GetURL(), StreamMode::READ);
@@ -1451,6 +1459,12 @@ void PdfExportTest::testTdf113143()
     CPPUNIT_ASSERT_LESS(nLarger, nSmaller);
 }
 
+void PdfExportTest::testForcePoint71()
+{
+    // I just care it doesn't crash
+    topdf("forcepoint71.key");
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(PdfExportTest);
 
 }
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx b/vcl/source/gdi/pdfwriter_impl.cxx
index 21ca8d478e5b..acec33b4ec5c 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -9009,7 +9009,11 @@ sal_Int32 PDFWriterImpl::copyExternalResource(SvMemoryStream& rDocBuffer, filter
         {
             // Copy the last part here, in the complex case.
             sal_uInt64 nDictEnd = rObject.GetDictionaryOffset() + rObject.GetDictionaryLength();
-            aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nDictEnd - nCopyStart);
+            const sal_Int32 nLen = nDictEnd - nCopyStart;
+            if (nLen < 0)
+                SAL_WARN("vcl.pdfwriter", "copyExternalResource() failed");
+            else
+                aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nLen);
         }
         else
             // Can copy it as-is.
@@ -9072,7 +9076,11 @@ sal_Int32 PDFWriterImpl::copyExternalResource(SvMemoryStream& rDocBuffer, filter
         {
             // Copy the last part here, in the complex case.
             sal_uInt64 nArrEnd = rObject.GetArrayOffset() + rObject.GetArrayLength();
-            aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nArrEnd - nCopyStart);
+            const sal_Int32 nLen = nArrEnd - nCopyStart;
+            if (nLen < 0)
+                SAL_WARN("vcl.pdfwriter", "copyExternalResource() failed");
+            else
+                aLine.append(static_cast<const sal_Char*>(rDocBuffer.GetData()) + nCopyStart, nLen);
         }
         else
             // Can copy it as-is.