ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#541854037 Timeout

Browse Source 
the polygon point counts were checked against the space left in the
whole file, and a small record inside a large file could claim far
more points than it holds

so bound them by the size of the record instead

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I0770546d0d48f9b306461da5e9c0117977079483
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12367
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 292bae6e2ee1d8749040b258cd7bf415cf6241b4)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211410
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-09-24 11:01:20 +02:00
committed by Xisco Fauli
parent 8bcb8dc7a9
commit 37fd5b78b0
1 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
emfio/source/reader/wmfreader.cxx
+22 -3
View File
@@ -348,6 +348,17 @@ namespace emfio
return Size( nW, nH );
}
// The number of points that fit in a record of nRecordSize words. A record starts with
// three words of header followed by nParameterWords of other parameters, and each point
// takes two words.
static sal_uInt32 MaxPointsInRecord(sal_uInt32 nRecordSize, sal_uInt32 nParameterWords)
{
const sal_uInt32 nUsedWords = 3 + nParameterWords;
if (nRecordSize <= nUsedWords)
return 0;
return (nRecordSize - nUsedWords) / 2;
}
void WmfReader::ReadRecordParams( sal_uInt32 nRecordSize, sal_uInt16 nFunc )
{
bool bRecordOk = true;
@@ -575,7 +586,7 @@ namespace emfio
sal_uInt16 nPoints(0);
mpInputStream->ReadUInt16(nPoints);
if (nPoints > mpInputStream->remainingSize() / (2 * sizeof(sal_uInt16)))
if (nPoints > MaxPointsInRecord(nRecordSize, 1))
{
bRecordOk = false;
}
@@ -600,7 +611,9 @@ namespace emfio
mpInputStream->ReadUInt16( nPolyCount );
if (nPolyCount && mpInputStream->good())
{
if (nPolyCount > mpInputStream->remainingSize() / sizeof(sal_uInt16))
// One word per polygon holds its point count, and those words sit between
// the polygon count and the points themselves.
if (nRecordSize < 4 || nPolyCount > nRecordSize - 4)
break;
// Number of points of each polygon. Determine total number of points
@@ -623,6 +636,12 @@ namespace emfio
SAL_WARN_IF(!bRecordOk, "emfio", "polypolygon record has more polygons than we can handle");
if (nPoints > MaxPointsInRecord(nRecordSize, 1 + nPolyCount))
{
SAL_WARN("emfio", "polypolygon record has more points than it can hold");
bRecordOk = false;
}
bRecordOk &= mpInputStream->good();
if (!bRecordOk)
@@ -665,7 +684,7 @@ namespace emfio
sal_uInt16 nPoints(0);
mpInputStream->ReadUInt16(nPoints);
if (nPoints > mpInputStream->remainingSize() / (2 * sizeof(sal_uInt16)))
if (nPoints > MaxPointsInRecord(nRecordSize, 1))
{
bRecordOk = false;
}