1. 25 Agu, 2015 14 kayıt (commit)
    • Stephan Bergmann's avatar
      Avoid overflow in PBMReader::ImplReadHeader · 4c8bba9a
      Stephan Bergmann yazdı
      ...as found by UBSan in CppunitTest_filter_ppm_test on
      filter/qa/cppunit/data/pbm/fail/crash-1.pbm
      
      Change-Id: Ib7c50ef1f07aba6b78f79c608be69c3dac38ddfe
      (cherry picked from commit 662498ab)
      Reviewed-on: https://gerrit.libreoffice.org/17984Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      4c8bba9a
    • Stephan Bergmann's avatar
      Handle non-aligned FFNs · db39370e
      Stephan Bergmann yazdı
      ...as found by UBSan in CppunitTest_sw_filters_test (see below), and at the same
      time limit reads within the pA array to its bounds.
      
      > Testing file:///.../sw/qa/core/data/ww6/pass/crash-2.doc:
      > sw/source/filter/ww8/ww8scan.cxx:6473:32: runtime error: upcast of misaligned address 0x6200000e70e7 for type 'WW8_FFN_Ver6', which requires 2 byte alignment
      > 0x6200000e70e7: note: pointer points here
      >  00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 0e 00 00 6a 00  00 00 00 0e 00 00 6a 00  00 00 6a
      >              ^
      >  WW8Fonts::WW8Fonts(SvStream&, WW8Fib&) sw/source/filter/ww8/ww8scan.cxx:6473:32
      >  SwWW8ImplReader::CoreLoad(WW8Glossary*, SwPosition const&) sw/source/filter/ww8/ww8par.cxx:4961:20
      >  SwWW8ImplReader::LoadThroughDecryption(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5767:19
      >  SwWW8ImplReader::LoadDoc(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:6039:19
      >  WW8Reader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) sw/source/filter/ww8/ww8par.cxx:6157:20
      >  SwReader::Read(Reader const&) sw/source/filter/basflt/shellio.cxx:175:18
      >  SwDocShell::ConvertFrom(SfxMedium&) sw/source/uibase/app/docsh.cxx:258:22
      >  SfxObjectShell::DoLoad(SfxMedium*) sfx2/source/doc/objstor.cxx:790:23
      >  SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) sw/qa/core/filters-test.cxx:112:20
      >  SwFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) sw/qa/core/filters-test.cxx:71:12
      >  test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:129:20
      >  test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:154:5
      >  SwFiltersTest::testCVEs() sw/qa/core/filters-test.cxx:154:5
      
      (cherry picked from commit 63738868)
      
      Change-Id: I31ac8dc11d985745785c9dda1cec8a11a41098bb
      Reviewed-on: https://gerrit.libreoffice.org/17985Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      db39370e
    • Khaled Hosny's avatar
      Fix GTK3 right-to-left rendering of spin buttons · 3a0ca274
      Khaled Hosny yazdı
      The buttons were not drawn at all
      
      Change-Id: I51dfa30a6daa1034b5e978b09bcdfcc83e859f3d
      Reviewed-on: https://gerrit.libreoffice.org/17790Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Reviewed-on: https://gerrit.libreoffice.org/17943Tested-by: 's avatarJenkins <ci@libreoffice.org>
      3a0ca274
    • Caolán McNamara's avatar
      don't mirror 0, RECT_EMPTY, 0, RECT_EMPTY rectangle · f9410a54
      Caolán McNamara yazdı
      leave it untouched to make gtk3 rtl spin buttons possible
      where the additional mirrorValue contains the region
      of the spinbuttons to render within this rectangle
      
      Change-Id: I2648d98ed36373c95947cc4d78e2e54797f01155
      Reviewed-on: https://gerrit.libreoffice.org/17940Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Reviewed-on: https://gerrit.libreoffice.org/17942Tested-by: 's avatarJenkins <ci@libreoffice.org>
      f9410a54
    • Zolnai Tamás's avatar
      tdf#91969: Parts of paragraph border is missing · 8f44345f
      Zolnai Tamás yazdı
      ...when border is around more than one paragraph
      
      Regression from:
      16f637da
      
      Change-Id: Iea9455dd7cc3c301c3e2d5d7903c98d98e515595
      (cherry picked from commit 8d933132)
      Reviewed-on: https://gerrit.libreoffice.org/17979Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      8f44345f
    • Michael Meeks's avatar
      tdf#93569 - restore ACT_ABORT distinction. · d5cc5bb3
      Michael Meeks yazdı
      In order to handle signals, we need to have ACT_ABORT in place
      and distinct from ACT_SYSTEM.
      
      cf. if (Signals[i].Action != ACT_SYSTEM) during setup.
      
      Change-Id: I8c69d48244ba462f2e2385a530cbbf4740ccee9a
      Reviewed-on: https://gerrit.libreoffice.org/17893Tested-by: 's avatarJenkins <ci@libreoffice.org>
      Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      d5cc5bb3
    • Caolán McNamara's avatar
      in reality we are limited to max sal_Int32 here · 25418bf4
      Caolán McNamara yazdı
      so accept that and test if the values were accepted or limited
      
      Change-Id: Iaed5ebc2f12b52055506147c71117a2ad88d28ac
      (cherry picked from commit 0a76c1fd)
      Reviewed-on: https://gerrit.libreoffice.org/17972Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      25418bf4
    • Caolán McNamara's avatar
      consider validity of m_nDrawCpO · 436ccb0d
      Caolán McNamara yazdı
      (cherry picked from commit 8329eb5e)
      
      Change-Id: Ifbd131440bad6d840d369c99628cb8904697ad96
      Reviewed-on: https://gerrit.libreoffice.org/17971Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      436ccb0d
    • Stephan Bergmann's avatar
      Handle GetBaseCp overflow · 1f3162c4
      Stephan Bergmann yazdı
      ...as found by UBSan in CppunitTest_sw_filters_test (see below); note the TODOs
      how best to report the errors up the call stack.
      
      > Testing file:///.../sw/qa/core/data/ww6/pass/crash-3.doc:
      > sw/source/filter/ww8/ww8scan.cxx:5240:63: runtime error: signed integer overflow: 1766665948 + 1768712052 cannot be represented in type 'int'
      >  WW8Fib::GetBaseCp(ManTypes) const sw/source/filter/ww8/ww8scan.cxx:5240:63
      >  SwWW8ImplReader::Read_GrafLayer(long) sw/source/filter/ww8/ww8graf.cxx:2393:18
      >  SwWW8ImplReader::ReadChar(long, long) sw/source/filter/ww8/ww8par.cxx:3630:17
      >  SwWW8ImplReader::ReadChars(int&, int, long, long) sw/source/filter/ww8/ww8par.cxx:3432:27
      >  SwWW8ImplReader::ReadText(int, int, ManTypes) sw/source/filter/ww8/ww8par.cxx:3970:22
      >  SwWW8ImplReader::CoreLoad(WW8Glossary*, SwPosition const&) sw/source/filter/ww8/ww8par.cxx:5169:9
      >  SwWW8ImplReader::LoadThroughDecryption(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5767:19
      >  SwWW8ImplReader::LoadDoc(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:6039:19
      >  WW8Reader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) sw/source/filter/ww8/ww8par.cxx:6157:20
      >  SwReader::Read(Reader const&) sw/source/filter/basflt/shellio.cxx:175:18
      >  SwDocShell::ConvertFrom(SfxMedium&) sw/source/uibase/app/docsh.cxx:258:22
      >  SfxObjectShell::DoLoad(SfxMedium*) sfx2/source/doc/objstor.cxx:790:23
      >  SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) sw/qa/core/filters-test.cxx:112:20
      >  SwFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) sw/qa/core/filters-test.cxx:71:12
      >  test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:129:20
      >  test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:154:5
      >  SwFiltersTest::testCVEs() sw/qa/core/filters-test.cxx:154:5
      
      Change-Id: I0b14f5c1e025565eb131e64590b7d5ff0135e767
      Reviewed-on: https://gerrit.libreoffice.org/17965Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      (cherry picked from commit d281b460)
      Reviewed-on: https://gerrit.libreoffice.org/17969Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      1f3162c4
    • Stephan Bergmann's avatar
      Handle zero nPLCF · e90c874f
      Stephan Bergmann yazdı
      ...as found by ASan in CppunitTest_sw_filters_test:
      
      > Testing file:///.../sw/qa/core/data/ww6/pass/crash-1.doc:
      > ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020009382b0 at pc 0x2b1dcb5eabac bp 0x7fffe8ccbdb0 sp 0x7fffe8ccbda8
      > READ of size 4 at 0x6020009382b0 thread T0
      >  WW8PLCF::SeekPos(int) sw/source/filter/ww8/ww8scan.cxx:2219:14
      >  WW8PLCF::WW8PLCF(SvStream&, int, int, int, int, int, int) sw/source/filter/ww8/ww8scan.cxx:2080:9
      >  WW8PLCFx_Fc_FKP::WW8PLCFx_Fc_FKP(SvStream*, SvStream*, SvStream*, WW8Fib const&, ePLCFT, int) sw/source/filter/ww8/ww8scan.cxx:2883:21
      >  WW8PLCFx_Cp_FKP::WW8PLCFx_Cp_FKP(SvStream*, SvStream*, SvStream*, WW8ScannerBase const&, ePLCFT) sw/source/filter/ww8/ww8scan.cxx:3088:7
      >  WW8ScannerBase::WW8ScannerBase(SvStream*, SvStream*, SvStream*, WW8Fib*) sw/source/filter/ww8/ww8scan.cxx:1588:20
      >  SwWW8ImplReader::CoreLoad(WW8Glossary*, SwPosition const&) sw/source/filter/ww8/ww8par.cxx:5022:20
      >  SwWW8ImplReader::LoadThroughDecryption(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5767:19
      >  SwWW8ImplReader::LoadDoc(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:6039:19
      >  WW8Reader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) sw/source/filter/ww8/ww8par.cxx:6157:20
      >  SwReader::Read(Reader const&) sw/source/filter/basflt/shellio.cxx:175:18
      >  SwDocShell::ConvertFrom(SfxMedium&) sw/source/uibase/app/docsh.cxx:258:22
      >  SfxObjectShell::DoLoad(SfxMedium*) sfx2/source/doc/objstor.cxx:790:23
      >  SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) sw/qa/core/filters-test.cxx:112:20
      >  SwFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) sw/qa/core/filters-test.cxx:71:12
      >  test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:129:20
      >  test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:154:5
      >  SwFiltersTest::testCVEs() sw/qa/core/filters-test.cxx:154:5
      > 0x6020009382b1 is located 0 bytes to the right of 1-byte region [0x6020009382b0,0x6020009382b1)
      > allocated by thread T0 here:
      >  operator new[](unsigned long) /home/sbergman/clang/trunk/src/projects/compiler-rt/lib/asan/asan_new_delete.cc:64
      >  WW8PLCF::ReadPLCF(SvStream&, int, unsigned int) sw/source/filter/ww8/ww8scan.cxx:2091:26
      >  WW8PLCF::WW8PLCF(SvStream&, int, int, int, int, int, int) sw/source/filter/ww8/ww8scan.cxx:2075:9
      >  WW8PLCFx_Fc_FKP::WW8PLCFx_Fc_FKP(SvStream*, SvStream*, SvStream*, WW8Fib const&, ePLCFT, int) sw/source/filter/ww8/ww8scan.cxx:2883:21
      >  WW8PLCFx_Cp_FKP::WW8PLCFx_Cp_FKP(SvStream*, SvStream*, SvStream*, WW8ScannerBase const&, ePLCFT) sw/source/filter/ww8/ww8scan.cxx:3088:7
      >  WW8ScannerBase::WW8ScannerBase(SvStream*, SvStream*, SvStream*, WW8Fib*) sw/source/filter/ww8/ww8scan.cxx:1588:20
      >  SwWW8ImplReader::CoreLoad(WW8Glossary*, SwPosition const&) sw/source/filter/ww8/ww8par.cxx:5022:20
      >  SwWW8ImplReader::LoadThroughDecryption(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5767:19
      >  SwWW8ImplReader::LoadDoc(SwPaM&, WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:6039:19
      >  WW8Reader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) sw/source/filter/ww8/ww8par.cxx:6157:20
      >  SwReader::Read(Reader const&) sw/source/filter/basflt/shellio.cxx:175:18
      >  SwDocShell::ConvertFrom(SfxMedium&) sw/source/uibase/app/docsh.cxx:258:22
      >  SfxObjectShell::DoLoad(SfxMedium*) sfx2/source/doc/objstor.cxx:790:23
      >  SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) sw/qa/core/filters-test.cxx:112:20
      >  SwFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) sw/qa/core/filters-test.cxx:71:12
      >  test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:129:20
      >  test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) unotest/source/cpp/filters-test.cxx:154:5
      >  SwFiltersTest::testCVEs() sw/qa/core/filters-test.cxx:154:5
      
      Change-Id: I97d995aad621b829b6fb6ee4622d386fec0bedea
      Reviewed-on: https://gerrit.libreoffice.org/17963Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
      (cherry picked from commit 1a871f9d)
      Reviewed-on: https://gerrit.libreoffice.org/17967Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      e90c874f
    • Caolán McNamara's avatar
      loop over successfully read bookmarks · ced9ee8e
      Caolán McNamara yazdı
      not over the amount that should be there
      
      Change-Id: Ia2c353f9d7e274a5bebf405e1743ef1d1872b4de
      (cherry picked from commit 02e9b490)
      Reviewed-on: https://gerrit.libreoffice.org/17958Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      ced9ee8e
    • Caolán McNamara's avatar
      detect and reject loop in tif · aed68b0c
      Caolán McNamara yazdı
      Change-Id: I77d315fa432a3eb1a65539489a2ba6da8508b283
      (cherry picked from commit 6b82437d)
      Reviewed-on: https://gerrit.libreoffice.org/17957Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      aed68b0c
    • Caolán McNamara's avatar
      limit seeks to valid area · d8b8bb7b
      Caolán McNamara yazdı
      (cherry picked from commit c0c90751)
      
      Change-Id: I401d93491999a3fc3db4f597eea9c4fe5b9bc926
      Reviewed-on: https://gerrit.libreoffice.org/17955Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      d8b8bb7b
    • Caolán McNamara's avatar
      guard against hangs with bogus unsorted plcfs · cce05bd5
      Caolán McNamara yazdı
      This reverts commit 6d21cbd1.
      
      Change-Id: I309302ab5357b8404ee4c75bd0bfcb4f816e0588
      (cherry picked from commit 74c0f744)
      Reviewed-on: https://gerrit.libreoffice.org/17951Reviewed-by: 's avatarDavid Tardon <dtardon@redhat.com>
      Tested-by: 's avatarDavid Tardon <dtardon@redhat.com>
      cce05bd5
  2. 24 Agu, 2015 4 kayıt (commit)
  3. 23 Agu, 2015 2 kayıt (commit)
  4. 22 Agu, 2015 3 kayıt (commit)
  5. 21 Agu, 2015 9 kayıt (commit)
  6. 20 Agu, 2015 8 kayıt (commit)