[Libreoffice-commits] online.git: fuzzer/admin-data wsd/Admin.cpp wsd/AdminModel.cpp

[Miklos Vajna (via logerrit)]

 fuzzer/admin-data/crash-d7d56f0e22a9d98aec2b34c4166c135fcb0128d3 |binary
 wsd/Admin.cpp                                                    |    2 +-
 wsd/AdminModel.cpp                                               |    5 +++++
 3 files changed, 6 insertions(+), 1 deletion(-)

New commits:
commit eeb4d53a1eb21f1018f3f3972b35576e6be8822a
Author:     Miklos Vajna <vmiklos at collabora.com>
AuthorDate: Mon Apr 20 14:54:44 2020 +0200
Commit:     Miklos Vajna <vmiklos at collabora.com>
CommitDate: Mon Apr 20 15:44:21 2020 +0200

    admin_fuzzer: fix too large param to mem stats size setter
    
    Change-Id: I30dfa5cd917769e05cfdd4fad2a0e5ee8cc79dfb
    Reviewed-on: https://gerrit.libreoffice.org/c/online/+/92568
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice at gmail.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.com>

diff --git a/fuzzer/admin-data/crash-d7d56f0e22a9d98aec2b34c4166c135fcb0128d3 b/fuzzer/admin-data/crash-d7d56f0e22a9d98aec2b34c4166c135fcb0128d3
new file mode 100644
index 000000000..4c2419878
Binary files /dev/null and b/fuzzer/admin-data/crash-d7d56f0e22a9d98aec2b34c4166c135fcb0128d3 differ
diff --git a/wsd/Admin.cpp b/wsd/Admin.cpp
index fccf8dd4f..ca84c5c6c 100644
--- a/wsd/Admin.cpp
+++ b/wsd/Admin.cpp
@@ -222,7 +222,7 @@ void AdminSocketHandler::handleMessage(const std::vector<char> &payload)
             const std::string settingName = setting[0];
             if (settingName == "mem_stats_size")
             {
-                if (settingVal != std::stoi(model.query(settingName)))
+                if (settingVal != std::stol(model.query(settingName)))
                 {
                     model.setMemStatsSize(settingVal);
                 }
diff --git a/wsd/AdminModel.cpp b/wsd/AdminModel.cpp
index 3caff4bb5..0d507e33e 100644
--- a/wsd/AdminModel.cpp
+++ b/wsd/AdminModel.cpp
@@ -420,6 +420,11 @@ void AdminModel::setMemStatsSize(unsigned size)
     int wasteValuesLen = _memStats.size() - size;
     while (wasteValuesLen-- > 0)
     {
+        if (_memStats.empty())
+        {
+            break;
+        }
+
         _memStats.pop_front();
     }
     _memStatsSize = size;