ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

Fix heap-use-after-free

Browse Source 
...as seen during CppunitTest_sd_tiledrendering2,

> ==1656617==ERROR: AddressSanitizer: heap-use-after-free on address 0x531000155fe7 at pc 0x55e2bd9ad71d bp 0x7ffde61a2210 sp 0x7ffde61a19d0
> READ of size 177 at 0x531000155fe7 thread T0
>     #0 0x55e2bd9ad71c in __asan_memcpy /home/tdf/lode/packages/llvm-llvmorg-18.1.8.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
>     #1 0x7f9c90d91bb2 in SvMemoryStream::PutData(void const*, unsigned long) /tools/source/stream/stream.cxx:1578:5
>     #2 0x7f9c90d6e77f in SvStream::WriteBytes(void const*, unsigned long) /tools/source/stream/stream.cxx:1195:26
>     #3 0x7f9c83b80030 in vcl::filter::PDFDocument::WriteCatalogObject(int, vcl::filter::PDFReferenceElement*&) /vcl/source/filter/ipdf/pdfdocument.cxx:577:27
>
> 0x531000155fe7 is located 6119 bytes inside of 65180-byte region [0x531000154800,0x53100016469c)
> freed by thread T0 here:
>     #0 0x55e2bd9faf30 in operator delete[](void*) /home/tdf/lode/packages/llvm-llvmorg-18.1.8.src/compiler-rt/lib/asan/asan_new_delete.cpp:146:3
>     #1 0x7f9c90d8f873 in SvMemoryStream::FreeMemory() /tools/source/stream/stream.cxx:1694:9
>     #2 0x7f9c90d92f0f in SvMemoryStream::ReAllocateMemory(long) /tools/source/stream/stream.cxx:1671:9
>     #3 0x7f9c90d91703 in SvMemoryStream::PutData(void const*, unsigned long) /tools/source/stream/stream.cxx:1569:22
>     #4 0x7f9c90d6e77f in SvStream::WriteBytes(void const*, unsigned long) /tools/source/stream/stream.cxx:1195:26
>     #5 0x7f9c83b80030 in vcl::filter::PDFDocument::WriteCatalogObject(int, vcl::filter::PDFReferenceElement*&) /vcl/source/filter/ipdf/pdfdocument.cxx:577:27

(<https://ci.libreoffice.org//job/lo_ubsan/3829/>)

Change-Id: I38abb9870ffcce3aaf198543e130898817d8fe3e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199944
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
This commit is contained in:
Stephan Bergmann
2026-02-21 17:10:55 +01:00
parent 1d9b441da8
commit 15995c4d46
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vcl/source/filter/ipdf/pdfdocument.cxx
+4 -3
View File
@@ -574,9 +574,10 @@ bool PDFDocument::WriteCatalogObject(sal_Int32 nAnnotId, PDFReferenceElement*& p
if (!pAcroFormDictionary)
{
// No AcroForm key, assume no signatures.
m_aEditBuffer.WriteBytes(static_cast<const char*>(m_aEditBuffer.GetData())
+ pCatalog->GetDictionaryOffset(),
pCatalog->GetDictionaryLength());
auto const p = static_cast<const char*>(m_aEditBuffer.GetData())
+ pCatalog->GetDictionaryOffset();
std::vector<char> copy(p, p + pCatalog->GetDictionaryLength());
m_aEditBuffer.WriteBytes(copy.data(), copy.size());
m_aEditBuffer.WriteOString("/AcroForm<</Fields[\n");
m_aEditBuffer.WriteNumberAsString(nAnnotId);
m_aEditBuffer.WriteOString(" 0 R\n]/SigFlags 3>>\n");