Skip to content

C
core
Kaydet (Commit) 8ee49906 authored tarafından Armin Le Grand's avatar Armin Le Grand
Dosyalara gözat
Seçenekler

Secured some places where PolyPolygons were created using a all-points count and a all-points array

üst 3c7cfb25
Hide whitespace changes
Inline Side-by-side
Showing with 89 additions and 77 deletions
svtools/source/filter/wmf/enhwmf.cxx
Dosyayı görüntüle @ 8ee49906
......@@ -336,8 +336,6 @@ sal_Bool EnhWMFReader::ReadEnhWMF()
case EMR_POLYPOLYLINE :
{
sal_uInt16* pnPoints;
sal_Int32 i, nPoly;
pWMF->SeekRel( 0x10 );
......@@ -349,9 +347,9 @@ sal_Bool EnhWMFReader::ReadEnhWMF()
{
if ( ( static_cast< sal_uInt32 >( nPoly ) * sizeof(sal_uInt16) ) <= ( nEndPos - pWMF->Tell() ) )
{
pnPoints = new sal_uInt16[ nPoly ];
sal_uInt16* pnPoints = new sal_uInt16[ nPoly ];
for ( i = 0; i < nPoly; i++ )
for ( i = 0; i < nPoly && !pWMF->IsEof(); i++ )
{
*pWMF >> nPoints;
pnPoints[ i ] = (sal_uInt16)nPoints;
......@@ -377,45 +375,55 @@ sal_Bool EnhWMFReader::ReadEnhWMF()
case EMR_POLYPOLYGON :
{
sal_uInt16* pnPoints;
Point* pPtAry;
sal_uInt32 i, nPoly, nGesPoints;
sal_uInt32 nPoly(0);
sal_uInt32 nGesPoints(0);
sal_uInt32 nReadPoints(0);
pWMF->SeekRel( 0x10 );
// Anzahl der Polygone:
*pWMF >> nPoly >> nGesPoints;
if ( ( nGesPoints < SAL_MAX_UINT32 / sizeof(Point) ) && ( nPoly < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) )
if ( ( nGesPoints < SAL_MAX_UINT32 / sizeof(Point) ) && ( nPoly < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) && !pWMF->IsEof() )
{
if ( ( nPoly * sizeof(sal_uInt16) ) <= ( nEndPos - pWMF->Tell() ) )
{
pnPoints = new sal_uInt16[ nPoly ];
sal_uInt32 i(0);
sal_uInt16* pnPoints = new sal_uInt16[ nPoly ];
for ( i = 0; i < nPoly; i++ )
for ( i = 0; i < nPoly && !pWMF->IsEof(); i++ )
{
*pWMF >> nPoints;
pnPoints[ i ] = (sal_uInt16)nPoints;
}
if ( ( nGesPoints * (sizeof(sal_uInt32)+sizeof(sal_uInt32)) ) <= ( nEndPos - pWMF->Tell() ) )
if ( ( nGesPoints * (sizeof(sal_uInt32)+sizeof(sal_uInt32)) ) <= ( nEndPos - pWMF->Tell() ) && !pWMF->IsEof())
{
// Polygonpunkte holen:
pPtAry = new Point[ nGesPoints ];
PolyPolygon aPolyPoly(nPoly, nPoly);
for ( i = 0; i < nGesPoints; i++ )
for ( i = 0; i < nPoly && !pWMF->IsEof(); i++ )
{
*pWMF >> nX32 >> nY32;
pPtAry[ i ] = Point( nX32, nY32 );
const sal_uInt16 nPointCount(pnPoints[i]);
Point* pPtAry = new Point[nPointCount];
for(sal_uInt16 j(0); j < nPointCount && !pWMF->IsEof(); j++)
{
*pWMF >> nX32 >> nY32;
pPtAry[ j ] = Point( nX32, nY32 );
nReadPoints++;
}
aPolyPoly.Insert(Polygon(nPointCount, pPtAry));
delete[] pPtAry;
}
// PolyPolygon Actions erzeugen
PolyPolygon aPolyPoly( (sal_uInt16)nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
delete[] pPtAry;
}
delete[] pnPoints;
}
}
OSL_ENSURE(nReadPoints == nGesPoints, "The number Points processed from EMR_POLYPOLYGON is unequal imported number (!)");
}
break;
......@@ -1204,41 +1212,55 @@ sal_Bool EnhWMFReader::ReadEnhWMF()
case EMR_POLYPOLYGON16 :
{
sal_uInt16* pnPoints;
Point* pPtAry;
sal_uInt32 i, nPoly, nGesPoints;
sal_uInt32 nPoly(0);
sal_uInt32 nGesPoints(0);
pWMF->SeekRel( 0x10 );
// Anzahl der Polygone:
*pWMF >> nPoly >> nGesPoints;
if ( ( nGesPoints < SAL_MAX_UINT32 / sizeof(Point) ) && ( nPoly < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) )
sal_uInt32 nReadPoints(0);
if ( ( nGesPoints < SAL_MAX_UINT32 / sizeof(Point) ) && ( nPoly < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) && !pWMF->IsEof() )
{
if ( ( static_cast< sal_uInt32 >( nPoly ) * sizeof( sal_uInt16 ) ) <= ( nEndPos - pWMF->Tell() ) )
{
pnPoints = new sal_uInt16[ nPoly ];
for ( i = 0; i < nPoly; i++ )
sal_uInt32 i(0);
sal_uInt16* pnPoints = new sal_uInt16[ nPoly ];
for ( i = 0; i < nPoly && !pWMF->IsEof(); i++ )
{
*pWMF >> nPoints;
pnPoints[ i ] = (sal_uInt16)nPoints;
}
if ( ( nGesPoints * (sizeof(sal_uInt16)+sizeof(sal_uInt16)) ) <= ( nEndPos - pWMF->Tell() ) )
if ( ( nGesPoints * (sizeof(sal_uInt16)+sizeof(sal_uInt16)) ) <= ( nEndPos - pWMF->Tell() ) && !pWMF->IsEof() )
{
// Polygonpunkte holen:
pPtAry = new Point[ nGesPoints ];
for ( i = 0; i < nGesPoints; i++ )
PolyPolygon aPolyPoly(nPoly, nPoly);
for ( i = 0; i < nPoly && !pWMF->IsEof(); i++ )
{
*pWMF >> nX16 >> nY16;
pPtAry[ i ] = Point( nX16, nY16 );
const sal_uInt16 nPointCount(pnPoints[i]);
Point* pPtAry = new Point[nPointCount];
for(sal_uInt16 b(0); b < nPointCount && !pWMF->IsEof(); b++)
{
*pWMF >> nX16 >> nY16;
pPtAry[b] = Point( nX16, nY16 );
nReadPoints++;
}
aPolyPoly.Insert(Polygon(nPointCount, pPtAry));
delete[] pPtAry;
}
// PolyPolygon Actions erzeugen
PolyPolygon aPolyPoly( (sal_uInt16)nPoly, pnPoints, pPtAry );
// create PolyPolygon actions
pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
delete[] pPtAry;
}
delete[] pnPoints;
}
}
OSL_ENSURE(nReadPoints == nGesPoints, "The number Points processed from EMR_POLYPOLYGON16 is unequal imported number (!)");
}
break;
......
svtools/source/filter/wmf/winwmf.cxx
Dosyayı görüntüle @ 8ee49906
......@@ -330,28 +330,39 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
case W_META_POLYPOLYGON:
{
sal_uInt16 i, nPoly, nPoints;
sal_uInt16* pnPoints;
Point* pPtAry;
// Anzahl der Polygone:
*pWMF >> nPoly;
// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
pnPoints = new sal_uInt16[ nPoly ];
nPoints = 0;
for( i = 0; i < nPoly; i++ )
sal_uInt16 nPolyCount(0);
// get number of polygons
*pWMF >> nPolyCount;
if(nPolyCount && !pWMF->IsEof())
{
*pWMF >> pnPoints[i];
nPoints = nPoints + pnPoints[i];
sal_uInt16* pnPoints = new sal_uInt16[nPolyCount];
sal_uInt16 a(0);
PolyPolygon aPolyPoly(nPolyCount, nPolyCount);
for(a = 0; a < nPolyCount && !pWMF->IsEof(); a++)
{
*pWMF >> pnPoints[a];
}
for(a = 0; a < nPolyCount && !pWMF->IsEof(); a++)
{
const sal_uInt16 nPointCount(pnPoints[a]);
Point* pPtAry = new Point[nPointCount];
for(sal_uInt16 b(0); b < nPointCount && !pWMF->IsEof(); b++)
{
pPtAry[b] = ReadPoint();
}
aPolyPoly.Insert(Polygon(nPointCount, pPtAry));
delete[] pPtAry;
}
delete[] pnPoints;
pOut->DrawPolyPolygon(aPolyPoly);
}
// Polygonpunkte holen:
pPtAry = (Point*) new char[ nPoints * sizeof(Point) ];
for ( i = 0; i < nPoints; i++ )
pPtAry[ i ] = ReadPoint();
// PolyPolygon Actions erzeugen
PolyPolygon aPolyPoly( nPoly, pnPoints, pPtAry );
pOut->DrawPolyPolygon( aPolyPoly );
delete[] (char*) pPtAry;
delete[] pnPoints;
}
break;
......
tools/inc/tools/poly.hxx
Dosyayı görüntüle @ 8ee49906
......@@ -261,8 +261,6 @@ public:
PolyPolygon( sal_uInt16 nInitSize = 16, sal_uInt16 nResize = 16 );
PolyPolygon( const Polygon& rPoly );
PolyPolygon( sal_uInt16 nPoly, const sal_uInt16* pPointCountAry,
const Point* pPtAry );
PolyPolygon( const PolyPolygon& rPolyPoly );
~PolyPolygon();
......
tools/source/generic/poly2.cxx
Dosyayı görüntüle @ 8ee49906
......@@ -123,25 +123,6 @@ PolyPolygon::PolyPolygon( const Polygon& rPoly )
// -----------------------------------------------------------------------
PolyPolygon::PolyPolygon( sal_uInt16 nPoly, const sal_uInt16* pPointCountAry,
const Point* pPtAry )
{
DBG_CTOR( PolyPolygon, NULL );
if ( nPoly > MAX_POLYGONS )
nPoly = MAX_POLYGONS;
mpImplPolyPolygon = new ImplPolyPolygon( nPoly );
for ( sal_uInt16 i = 0; i < nPoly; i++ )
{
mpImplPolyPolygon->mpPolyAry[i] = new Polygon( *pPointCountAry, pPtAry );
pPtAry += *pPointCountAry;
pPointCountAry++;
}
}
// -----------------------------------------------------------------------
PolyPolygon::PolyPolygon( const PolyPolygon& rPolyPoly )
{
DBG_CTOR( PolyPolygon, NULL );
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment