Kaydet (Commit) 8f97326b authored tarafından Stephan Bergmann's avatar Stephan Bergmann

So ZCodec::ReadAsynchron was wrong in using a persistent mpIStm after all

The fun thing is that with the (only) call-site to ReadAsynchron in
PNGReaderImpl::ImplReadIDAT (vcl/source/gdi/pngread.cxx) passing in rIStm
references to stack-allocated SvMemoryStream instances, mpIStm could point to an
old, destroyed instance from a previous call, but which would have been located
at exactly the same stack address as the currently passed in rIStm, so the wrong
mpIStm->Read call would effectively behaved exactly the same as a correct
rIStm.Read call.

This went unnoticed "since the beginning" until AddressSanitizer's
UseAfterReturn check came along...

Change-Id: I7c75ed2d36a4c24c111d88eff647816bd2c5dbca
üst c5a603ce
...@@ -39,7 +39,6 @@ class TOOLS_DLLPUBLIC ZCodec ...@@ -39,7 +39,6 @@ class TOOLS_DLLPUBLIC ZCodec
State meState; State meState;
bool mbStatus; bool mbStatus;
bool mbFinish; bool mbFinish;
SvStream* mpIStm;
sal_uInt8* mpInBuf; sal_uInt8* mpInBuf;
sal_uIntPtr mnInBufSize; sal_uIntPtr mnInBufSize;
sal_uIntPtr mnInToRead; sal_uIntPtr mnInToRead;
......
...@@ -41,7 +41,6 @@ ZCodec::ZCodec( sal_uIntPtr nInBufSize, sal_uIntPtr nOutBufSize ) ...@@ -41,7 +41,6 @@ ZCodec::ZCodec( sal_uIntPtr nInBufSize, sal_uIntPtr nOutBufSize )
: meState(STATE_INIT) : meState(STATE_INIT)
, mbStatus(false) , mbStatus(false)
, mbFinish(false) , mbFinish(false)
, mpIStm(NULL)
, mpInBuf(NULL) , mpInBuf(NULL)
, mnInBufSize(nInBufSize) , mnInBufSize(nInBufSize)
, mnInToRead(0) , mnInToRead(0)
...@@ -66,7 +65,7 @@ void ZCodec::BeginCompression( int nCompressLevel, bool updateCrc, bool gzLib ) ...@@ -66,7 +65,7 @@ void ZCodec::BeginCompression( int nCompressLevel, bool updateCrc, bool gzLib )
assert(meState == STATE_INIT); assert(meState == STATE_INIT);
mbStatus = true; mbStatus = true;
mbFinish = false; mbFinish = false;
mpIStm = mpOStm = NULL; mpOStm = NULL;
mnInToRead = 0xffffffff; mnInToRead = 0xffffffff;
mpInBuf = mpOutBuf = NULL; mpInBuf = mpOutBuf = NULL;
PZSTREAM->total_out = PZSTREAM->total_in = 0; PZSTREAM->total_out = PZSTREAM->total_in = 0;
...@@ -249,7 +248,6 @@ long ZCodec::ReadAsynchron( SvStream& rIStm, sal_uInt8* pData, sal_uIntPtr nSize ...@@ -249,7 +248,6 @@ long ZCodec::ReadAsynchron( SvStream& rIStm, sal_uInt8* pData, sal_uIntPtr nSize
if (meState == STATE_INIT) if (meState == STATE_INIT)
{ {
InitDecompress(rIStm); InitDecompress(rIStm);
mpIStm = &rIStm;
} }
PZSTREAM->avail_out = nSize; PZSTREAM->avail_out = nSize;
PZSTREAM->next_out = pData; PZSTREAM->next_out = pData;
...@@ -267,7 +265,7 @@ long ZCodec::ReadAsynchron( SvStream& rIStm, sal_uInt8* pData, sal_uIntPtr nSize ...@@ -267,7 +265,7 @@ long ZCodec::ReadAsynchron( SvStream& rIStm, sal_uInt8* pData, sal_uIntPtr nSize
break; break;
} }
PZSTREAM->avail_in = mpIStm->Read ( PZSTREAM->avail_in = rIStm.Read (
PZSTREAM->next_in = mpInBuf, nInToRead); PZSTREAM->next_in = mpInBuf, nInToRead);
mnInToRead -= nInToRead; mnInToRead -= nInToRead;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment