[Libreoffice-commits] online.git: Branch 'distro/collabora/collabora-online-4-0' - test/helpers.hpp test/httpwstest.cpp

Ashod Nakashian (via logerrit) logerrit at kemper.freedesktop.org
Sat Oct 19 18:58:36 UTC 2019


 test/helpers.hpp    |    4 ++--
 test/httpwstest.cpp |   37 +++++++++++++++++++++++++++++--------
 2 files changed, 31 insertions(+), 10 deletions(-)

New commits:
commit 93abce99d02aa417feeae12f9232b0be83a74e35
Author:     Ashod Nakashian <ashod.nakashian at collabora.co.uk>
AuthorDate: Sun Oct 13 21:27:53 2019 -0400
Commit:     Andras Timar <andras.timar at collabora.com>
CommitDate: Sat Oct 19 20:58:17 2019 +0200

    test: fix segfault due to invalid iterator position
    
    The SVG can have self-closing tags, which wasn't accounted
    for. Finding end-tags that aren't matching start tags
    resulted in segfaults due to out-of-bounds writing.
    
    Change-Id: I749ba7f59351cf635fdc1cd30b3be5260b3c6b16
    Reviewed-on: https://gerrit.libreoffice.org/80895
    Reviewed-by: Andras Timar <andras.timar at collabora.com>
    Tested-by: Andras Timar <andras.timar at collabora.com>

diff --git a/test/helpers.hpp b/test/helpers.hpp
index 480c5ca6e..caa3390e3 100644
--- a/test/helpers.hpp
+++ b/test/helpers.hpp
@@ -673,9 +673,9 @@ inline bool svgMatch(const char *testname, const std::vector<char> &response, co
         newName += ".new";
         TST_LOG_APPEND("Updated template writing to: " << newName << "\n");
         TST_LOG_END;
+
         FILE *of = fopen(Poco::Path(TDOC, newName).toString().c_str(), "w");
-        size_t unused = fwrite(response.data(), response.size(), 1, of);
-        (void)unused;
+        CPPUNIT_ASSERT(fwrite(response.data(), response.size(), 1, of) == response.size());
         fclose(of);
         return false;
     }
diff --git a/test/httpwstest.cpp b/test/httpwstest.cpp
index 012938f2a..6c6e9a625 100644
--- a/test/httpwstest.cpp
+++ b/test/httpwstest.cpp
@@ -60,19 +60,40 @@ namespace
  */
 void stripDescriptions(std::vector<char>& svg)
 {
+    static const std::string startDesc("<desc>");
+    static const std::string endDesc("</desc>");
+    static const std::string selfClose("/>");
+
     while (true)
     {
-        std::string startDesc("<desc>");
-        auto itStart = std::search(svg.begin(), svg.end(), startDesc.begin(), startDesc.end());
+        const auto itStart = std::search(svg.begin(), svg.end(), startDesc.begin(), startDesc.end());
         if (itStart == svg.end())
             return;
 
-        std::string endDesc("</desc>");
-        auto itEnd = std::search(svg.begin(), svg.end(), endDesc.begin(), endDesc.end());
-        if (itEnd == svg.end())
-            return;
+        const auto itClose = std::search(itStart + 1, svg.end(), selfClose.begin(), selfClose.end());
 
-        svg.erase(itStart, itEnd + endDesc.size());
+        const auto itEnd = std::search(itStart + 1, svg.end(), endDesc.begin(), endDesc.end());
+
+        if (itEnd != svg.end() && itClose != svg.end())
+        {
+            if (itEnd < itClose)
+                svg.erase(itStart, itEnd + endDesc.size());
+            else
+                svg.erase(itStart, itClose + selfClose.size());
+        }
+        else if (itEnd != svg.end())
+        {
+            svg.erase(itStart, itEnd + endDesc.size());
+        }
+        else if (itClose != svg.end())
+        {
+            svg.erase(itStart, itClose + selfClose.size());
+        }
+        else
+        {
+            // No more closing tags; possibly broken, as we found an opening tag.
+            return;
+        }
     }
 }
 }
@@ -2707,7 +2728,7 @@ void HTTPWSTest::testRenderShapeSelectionImpress()
         sendTextFrame(socket, "rendershapeselection mimetype=image/svg+xml", testname);
         std::vector<char> responseSVG = getResponseMessage(socket, "shapeselectioncontent:", testname);
         CPPUNIT_ASSERT(!responseSVG.empty());
-        auto it = std::find(responseSVG.begin(), responseSVG.end(),'\n');
+        auto it = std::find(responseSVG.begin(), responseSVG.end(), '\n');
         if (it != responseSVG.end())
             responseSVG.erase(responseSVG.begin(), ++it);
 


More information about the Libreoffice-commits mailing list