[Libreoffice-commits] core.git: emfio/source
Caolán McNamara
caolanm at redhat.com
Thu Feb 8 14:27:11 UTC 2018
emfio/source/reader/emfreader.cxx | 48 ++++++++++++++++++++------------------
1 file changed, 26 insertions(+), 22 deletions(-)
New commits:
commit af8fc34702d9f7d73a81541cab2983bbdc7b6636
Author: Caolán McNamara <caolanm at redhat.com>
Date: Thu Feb 8 10:29:16 2018 +0000
ofz: timeout
Change-Id: Ia99ce4efe5ad7740f1cae7afcc199bc164b760ca
Reviewed-on: https://gerrit.libreoffice.org/49418
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index fdb8dbf43cbb..38b26086993d 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -335,30 +335,34 @@ bool ImplReadRegion( tools::PolyPolygon& rPolyPoly, SvStream& rStream, sal_uInt3
rStream.ReadUInt32(nCount);
rStream.ReadUInt32(nRgnSize);
- if ( nCount > 0
- && nType == RDH_RECTANGLES
- && nLen >= ((nCount << 4) + (nHdSize - 16)))
- {
- sal_Int32 nx1, ny1, nx2, ny2;
+ if (!rStream.good() || nCount == 0 || nType != RDH_RECTANGLES)
+ return false;
- for (i = 0; i < nCount; i++)
- {
- rStream.ReadInt32(nx1);
- rStream.ReadInt32(ny1);
- rStream.ReadInt32(nx2);
- rStream.ReadInt32(ny2);
-
- tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
-
- tools::Polygon aPolygon(aRectangle);
- tools::PolyPolygon aPolyPolyOr1(aPolygon);
- tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
- rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
- rPolyPoly = aPolyPolyOr2;
- }
- return true;
+ sal_uInt32 nSize;
+ if (o3tl::checked_multiply<sal_uInt32>(nCount, 16, nSize))
+ return false;
+ if (o3tl::checked_add<sal_uInt32>(nSize, nHdSize - 16, nSize))
+ return false;
+ if (nLen < nSize)
+ return false;
+
+ sal_Int32 nx1, ny1, nx2, ny2;
+ for (i = 0; i < nCount; i++)
+ {
+ rStream.ReadInt32(nx1);
+ rStream.ReadInt32(ny1);
+ rStream.ReadInt32(nx2);
+ rStream.ReadInt32(ny2);
+
+ tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
+
+ tools::Polygon aPolygon(aRectangle);
+ tools::PolyPolygon aPolyPolyOr1(aPolygon);
+ tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
+ rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
+ rPolyPoly = aPolyPolyOr2;
}
- return false;
+ return true;
}
} // anonymous namespace
More information about the Libreoffice-commits
mailing list