[Libreoffice-commits] core.git: svtools/source

[Libreoffice Gerrit user]

 svtools/source/svhtml/parhtml.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 47b8e414dd6f034a94f594c237c428c69a07f0cf
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 23 09:39:05 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Aug 23 13:32:53 2018 +0200

    ofz#10022 oom in htmlfuzzer
    
    Change-Id: Ia33b10e0184cb97cf895a9c926a81863c281b1f4
    Reviewed-on: https://gerrit.libreoffice.org/59490
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svtools/source/svhtml/parhtml.cxx b/svtools/source/svhtml/parhtml.cxx
index fa31a1271d95..14ed546ca9fe 100644
--- a/svtools/source/svhtml/parhtml.cxx
+++ b/svtools/source/svhtml/parhtml.cxx
@@ -1142,6 +1142,7 @@ HtmlTokenId HTMLParser::GetNextToken_()
 
                         bool bDone = false;
                         // Read until closing -->. If not found restart at first >
+                        sTmpBuffer = aToken;
                         while( !bDone && !rInput.eof() && IsParserWorking() )
                         {
                             if( '>'==nNextCh )
@@ -1149,19 +1150,20 @@ HtmlTokenId HTMLParser::GetNextToken_()
                                 if( !nCStreamPos )
                                 {
                                     nCStreamPos = rInput.Tell();
-                                    nCStrLen = aToken.getLength();
+                                    nCStrLen = sTmpBuffer.getLength();
                                     nCLineNr = GetLineNr();
                                     nCLinePos = GetLinePos();
                                 }
-                                bDone = aToken.endsWith( "--" );
+                                bDone = sTmpBuffer.getLength() >= 2 && sTmpBuffer[sTmpBuffer.getLength() - 2] == '-' && sTmpBuffer[sTmpBuffer.getLength() - 1] == '-';
                                 if( !bDone )
-                                aToken += OUString(&nNextCh,1);
+                                    sTmpBuffer.appendUtf32(nNextCh);
                             }
                             else
-                                aToken += OUString(&nNextCh,1);
+                                sTmpBuffer.appendUtf32(nNextCh);
                             if( !bDone )
                                 nNextCh = GetNextChar();
                         }
+                        aToken = sTmpBuffer.makeStringAndClear();
                         if( !bDone && IsParserWorking() && nCStreamPos )
                         {
                             rInput.Seek( nCStreamPos );