Kaydet (Commit) f5d33e5e authored tarafından Caolán McNamara's avatar Caolán McNamara

Resolves: coverity#706171 Untrusted value as argument

limit nBytesToRead to remaining size of file

also zero last byte of alloced block, seeing as the
block is size+1 and we only read size into it

Change-Id: I2729ec7bb9de20731531f32da864c572fa83ce58
üst 8306c25e
...@@ -248,12 +248,12 @@ bool psp::convertPfbToPfa( ::osl::File& rInFile, ::osl::File& rOutFile ) ...@@ -248,12 +248,12 @@ bool psp::convertPfbToPfa( ::osl::File& rInFile, ::osl::File& rOutFile )
bool bSuccess = true; bool bSuccess = true;
bool bEof = false; bool bEof = false;
unsigned char buffer[256]; unsigned char buffer[256];
sal_uInt64 nRead; sal_uInt64 nSize(0);
sal_uInt64 nOrgPos = 0; rInFile.getSize(nSize);
rInFile.getPos( nOrgPos );
while( bSuccess && ! bEof ) while( bSuccess && ! bEof )
{ {
sal_uInt64 nRead;
// read leading bytes // read leading bytes
bEof = ((0 != rInFile.read( buffer, 6, nRead)) || (nRead != 6)); bEof = ((0 != rInFile.read( buffer, 6, nRead)) || (nRead != 6));
if( bEof ) if( bEof )
...@@ -285,7 +285,12 @@ bool psp::convertPfbToPfa( ::osl::File& rInFile, ::osl::File& rOutFile ) ...@@ -285,7 +285,12 @@ bool psp::convertPfbToPfa( ::osl::File& rInFile, ::osl::File& rOutFile )
} }
else if( nType == 1 || nType == 2 ) else if( nType == 1 || nType == 2 )
{ {
boost::scoped_array<unsigned char> pBuffer(new unsigned char[ nBytesToRead+1 ]); sal_uInt64 nOrgPos(0);
rInFile.getPos(nOrgPos);
nBytesToRead = std::min<sal_uInt64>(nBytesToRead, nSize - nOrgPos);
boost::scoped_array<unsigned char> pBuffer(new unsigned char[nBytesToRead+1]);
pBuffer[nBytesToRead] = 0;
if( ! rInFile.read( pBuffer.get(), nBytesToRead, nRead ) && nRead == nBytesToRead ) if( ! rInFile.read( pBuffer.get(), nBytesToRead, nRead ) && nRead == nBytesToRead )
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment