Skip to content

C
core
Kaydet (Commit) a177c4c7 authored tarafından Stephan Bergmann's avatar Stephan Bergmann
Dosyalara gözat
Seçenekler

Avoid overflow 

Change-Id: Ia80682aeb87225b9bde7398186e121b1d3bdc2ad
üst 9ffb35db
Hide whitespace changes
Inline Side-by-side
Showing with 9 additions and 3 deletions
unoidl/source/unoidlprovider.cxx
Dosyayı görüntüle @ a177c4c7
......@@ -630,7 +630,9 @@ rtl::Reference< Entity > readEntity(
throw FileFormatException(
file->uri, "UNOIDL format: too many items in module");
}
if (offset + 5 + 8 * n > file->size) { //TODO: overflow
if (sal_uInt64(offset) + 5 + 8 * sal_uInt64(n) > file->size)
// cannot overflow
{
throw FileFormatException(
file->uri,
"UNOIDL format: module map offset + size too large");
......@@ -954,7 +956,9 @@ rtl::Reference< Entity > readEntity(
file->uri,
"UNOIDL format: too many constants in constant group");
}
if (offset + 5 + 8 * n > file->size) { //TODO: overflow
if (sal_uInt64(offset) + 5 + 8 * sal_uInt64(n) > file->size)
// cannot overflow
{
throw FileFormatException(
file->uri,
("UNOIDL format: constant group map offset + size too"
......@@ -1237,7 +1241,9 @@ rtl::Reference< Entity > UnoidlProvider::findEntity(OUString const & name) const
}
}
mapSize = file_->read32(off + 1);
if (8 * mapSize > file_->size - off - 5) { //TODO: overflow
if (sal_uInt64(off) + 5 + 8 * sal_uInt64(mapSize) > file_->size)
// cannot overflow
{
throw FileFormatException(
file_->uri, "UNOIDL format: map offset + size too large");
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment