ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#552117139 Out-of-memory

Browse Source 
the count in the file can be far more rectangles than the rest of
the record could hold

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I220e5eb3c5a99f7a7d6114aaa429234fa4a31906
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12357
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f92f34584421532774a762ec98688db7196badb0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211408
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-09-24 11:01:11 +02:00
committed by Xisco Fauli
parent a0ffcdfe62
commit 99e022072c
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drawinglayer/source/tools/emfphelperdata.cxx
+13
View File
@@ -1844,6 +1844,19 @@ namespace emfplushelper
}
rMS.ReadUInt32(rectangles);
// The record that is left says how many rectangles there can really be,
// whatever count the file gave.
const sal_uInt32 nBytesPerRectangle = (flags & 0x4000) ? 8 : 16;
const sal_uInt64 nRecordLeft
= rMS.Tell() < next ? std::min(next - rMS.Tell(), rMS.remainingSize())
: 0;
const sal_uInt64 nMaxRectangles = nRecordLeft / nBytesPerRectangle;
if (rectangles > nMaxRectangles)
{
SAL_WARN("drawinglayer.emf", "EMF+\twants " << rectangles
<< " rectangles, the record holds " << nMaxRectangles);
rectangles = static_cast<sal_uInt32>(nMaxRectangles);
}
for (sal_uInt32 i = 0; i < rectangles; i++)
{
ReadRectangle(rMS, x, y, width, height, bool(flags & 0x4000));