[Libreoffice-commits] core.git: 2 commits - hwpfilter/source writerfilter/source

[Caolán McNamara (via logerrit)]

 hwpfilter/source/hwpread.cxx                             |    9 +++++++++
 writerfilter/source/dmapper/DomainMapperTableHandler.cxx |   11 +++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

New commits:
commit 60ef0a2ff7fad0d94f4cc5020df3aee14568a82c
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Oct 4 15:57:04 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Oct 4 22:18:19 2019 +0200

    ofz#17992 null deref
    
    presumably since...
    
    commit f9aac900ada3d507526eeeed5b51fc7a10ab4cae
    Date:   Wed Oct 2 14:57:16 2019 +0200
    
        tdf#81100 DOCX import: repeat header according to table style
    
    Change-Id: I4f093606a15909c8e29b18dfb792abd938a80c5b
    Reviewed-on: https://gerrit.libreoffice.org/80234
    Reviewed-by: László Németh <nemeth at numbertext.org>
    Tested-by: Jenkins

diff --git a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
index 859c8c4415c5..be87c2c3785f 100644
--- a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
@@ -439,10 +439,13 @@ TableStyleSheetEntry * DomainMapperTableHandler::endTableGetTableStyle(TableInfo
                 m_aTableProperties->dumpXml();
                 TagLogger::getInstance().endElement();
 #endif
-                // apply tblHeader setting of the table style
-                PropertyMapPtr pHeaderStyleProps = pTableStyle->GetProperties(CNF_FIRST_ROW);
-                if ( pHeaderStyleProps->getProperty(PROP_HEADER_ROW_COUNT) )
-                    m_aTableProperties->Insert(PROP_HEADER_ROW_COUNT, uno::makeAny( sal_Int32(1)), false);
+                if (pTableStyle)
+                {
+                    // apply tblHeader setting of the table style
+                    PropertyMapPtr pHeaderStyleProps = pTableStyle->GetProperties(CNF_FIRST_ROW);
+                    if ( pHeaderStyleProps->getProperty(PROP_HEADER_ROW_COUNT) )
+                        m_aTableProperties->Insert(PROP_HEADER_ROW_COUNT, uno::makeAny( sal_Int32(1)), false);
+                }
             }
         }
 
commit 8bb5b028b975b9a92d053a784f7940cc6c4fe97f
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Oct 4 16:32:07 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Oct 4 22:18:09 2019 +0200

    ofz#17823 avoid timeout
    
    Change-Id: I3658d476873a502adc0cbd8be9a4f6ffd5b62c87
    Reviewed-on: https://gerrit.libreoffice.org/80236
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 86c2dea33494..d734d58f0335 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -20,6 +20,7 @@
 #include "precompile.h"
 
 #include <comphelper/newarray.hxx>
+#include <unotools/configmgr.hxx>
 
 #include <assert.h>
 #include <list>
@@ -376,6 +377,10 @@ bool Picture::Read(HWPFile & hwpf)
     hwpf.AddBox(this);
 
     hwpf.Read4b(&follow_block_size, 1);
+
+    //when fuzzing with a max len set, max decompress to 10 times that limit
+    static size_t nMaxAllowedDecompression = [](const char* pEnv) { size_t nRet = pEnv ? std::atoi(pEnv) : 0; return nRet * 10; }(std::getenv("FUZZ_MAX_INPUT_LEN"));
+
     hwpf.Read2b(&dummy1, 1);                      /* Reserved 4 bytes */
     hwpf.Read2b(&dummy2, 1);
 
@@ -455,6 +460,8 @@ bool Picture::Read(HWPFile & hwpf)
            }
            if (nBlock != nReadBlock)
                break;
+           if (nMaxAllowedDecompression && follow.size() > nMaxAllowedDecompression)
+               break;
         }
         follow_block_size = follow.size();
 
@@ -476,6 +483,8 @@ bool Picture::Read(HWPFile & hwpf)
                 ishyper = true;
             }
         }
+        else
+            fprintf(stderr, "arse\n");
     }
 
     if( pictype != 3 )