From 15abdbe674d5eaadf6c1a273809466519f09b395 Mon Sep 17 00:00:00 2001 From: Noel Grandin Date: Thu, 18 Sep 2025 13:18:16 +0200 Subject: [PATCH] fix integer overflow in SaxWriterHelper (tdf#167205) found while investigating the bug mentioned, sadly does not fix it Change-Id: I669c50d718fcb219a854513aa0a0cb89dadbd435 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/191119 Tested-by: Jenkins Reviewed-by: Noel Grandin --- sax/source/expatwrap/saxwriter.cxx | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/sax/source/expatwrap/saxwriter.cxx b/sax/source/expatwrap/saxwriter.cxx index 75860f62550e..861a4ce76f2b 100644 --- a/sax/source/expatwrap/saxwriter.cxx +++ b/sax/source/expatwrap/saxwriter.cxx @@ -93,8 +93,8 @@ private: Sequence m_Sequence; sal_Int8* mp_Sequence; - sal_Int32 nLastLineFeedPos; // is negative after writing a sequence - sal_uInt32 nCurrentPos; + sal_Int64 nLastLineFeedPos; // is negative after writing a sequence + sal_uInt64 nCurrentPos; bool m_bStartElementFinished; std::vector m_Replacements; @@ -106,11 +106,11 @@ private: // so the sequence has to write out and reset rPos to 0 // writes sequence only on overflow, sequence could be full on the end (rPos == SEQUENCESIZE) /// @throws SAXException - void AddBytes(sal_Int8* pTarget, sal_uInt32& rPos, const sal_Int8* pBytes, + void AddBytes(sal_Int8* pTarget, sal_uInt64& rPos, const sal_Int8* pBytes, sal_uInt32 nBytesCount); /// @throws SAXException bool convertToXML(const sal_Unicode* pStr, sal_Int32 nStrLen, bool bDoNormalization, - bool bNormalizeWhitespace, sal_Int8* pTarget, sal_uInt32& rPos); + bool bNormalizeWhitespace, sal_Int8* pTarget, sal_uInt64& rPos); /// @throws SAXException void FinishStartElement(); @@ -145,7 +145,7 @@ public: bool writeString(const OUString& rWriteOutString, bool bDoNormalization, bool bNormalizeWhitespace); - sal_uInt32 GetLastColumnCount() const noexcept + sal_uInt64 GetLastColumnCount() const noexcept { return static_cast(nCurrentPos - nLastLineFeedPos); } @@ -237,7 +237,7 @@ sal_uInt32 SaxWriterHelper::writeSequence() return 0; } -void SaxWriterHelper::AddBytes(sal_Int8* pTarget, sal_uInt32& rPos, const sal_Int8* pBytes, +void SaxWriterHelper::AddBytes(sal_Int8* pTarget, sal_uInt64& rPos, const sal_Int8* pBytes, sal_uInt32 nBytesCount) { OSL_ENSURE((rPos + nBytesCount) > SEQUENCESIZE, "wrong use of AddBytesMethod"); @@ -279,7 +279,7 @@ void SaxWriterHelper::setCustomEntityNames( */ bool SaxWriterHelper::convertToXML(const sal_Unicode* pStr, sal_Int32 nStrLen, bool bDoNormalization, bool bNormalizeWhitespace, - sal_Int8* pTarget, sal_uInt32& rPos) + sal_Int8* pTarget, sal_uInt64& rPos) { bool bRet(true); sal_uInt32 nSurrogate = 0;