check for ridiculous lengths and check stream status

Change-Id: Iefe943794e005f03b2a6ea5fc642b8c3d21b3334

check for ridiculous lengths and check stream status
Change-Id: Iefe943794e005f03b2a6ea5fc642b8c3d21b3334
858257d4 · Caolán McNamara · 43691a15 · 858257d4 · 858257d4
Kaydet (Commit) 858257d4 authored Agu 31, 2015 tarafından Caolán McNamara
Show whitespace changes
Inline Side-by-side

Showing with 12 additions and 8 deletions

hang-6.doc sw/qa/core/data/ww8/pass/hang-6.doc +0 -0

ww8par.cxx sw/source/filter/ww8/ww8par.cxx +12 -8

No files found.
--- a/sw/qa/core/data/ww8/pass/hang-6.doc
+++ b/sw/qa/core/data/ww8/pass/hang-6.doc
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -680,15 +680,21 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
            && maShapeRecords.Current()->nRecLen )
        {
            sal_uInt32 nBytesLeft = maShapeRecords.Current()->nRecLen;
-            sal_uInt32  nUDData;
+            auto nAvailableBytes = rSt.remainingSize();
-            sal_uInt16  nPID;
+            if (nBytesLeft > nAvailableBytes)
+            {
+                SAL_WARN("sw.ww8", "Document claimed to have shape record of " << nBytesLeft << " bytes, but only " << nAvailableBytes << " available");
+                nBytesLeft = nAvailableBytes;
+            }
            while( 5 < nBytesLeft )
            {
-                rSt.ReadUInt16( nPID );
+                sal_uInt16 nPID(0);
-                if ( rSt.GetError() != 0 )
+                rSt.ReadUInt16(nPID);
+                sal_uInt32 nUDData(0);
+                rSt.ReadUInt32(nUDData);
+                if (!rSt.good())
                    break;
-                rSt.ReadUInt32( nUDData );
+                switch (nPID)
-                switch( nPID )
                {
                    case 0x038F: pImpRec->nXAlign = nUDData; break;
                    case 0x0390:
@@ -716,8 +722,6 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
                        pImpRec->isHorizontalRule = true;
                        break;
                }
-                if ( rSt.GetError() != 0 )
-                    break;
                nBytesLeft  -= 6;
            }
        }