ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz: rtf, limit \bin reads to the bytes left in the stream

Browse Source 
Change-Id: I3a1167fe65e9b3e86502707fa796c21b2846a6e8
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8142
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 72f836bfd346ca5d62a1f9bc2f3c3d5d4cd87b8c)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208840
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
This commit is contained in:
Caolán McNamara
2026-07-30 18:13:37 +02:00
committed by Xisco Fauli
parent b7b2913bdc
commit d9d87d79ce
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx
+13 -3
View File
@@ -1317,10 +1317,20 @@ RTFError RTFDocumentImpl::resolveChars(char ch)
{
m_pBinaryData = std::make_shared<SvMemoryStream>();
m_pBinaryData->WriteChar(ch);
for (int i = 0; i < m_aStates.top().getBinaryToRead() - 1; ++i)
const int nBinaryToRead = m_aStates.top().getBinaryToRead();
SAL_WARN_IF(nBinaryToRead < 0, "writerfilter.rtf",
"negative \\bin length of " << nBinaryToRead);
if (nBinaryToRead > 1)
{
Strm().ReadChar(ch);
m_pBinaryData->WriteChar(ch);
const sal_uInt64 nWanted = nBinaryToRead - 1;
const sal_uInt64 nCount = std::min(nWanted, Strm().remainingSize());
SAL_WARN_IF(nCount < nWanted, "writerfilter.rtf",
"\\bin asks for " << nWanted << " bytes with only " << nCount << " left");
for (sal_uInt64 i = 0; i < nCount; ++i)
{
Strm().ReadChar(ch);
m_pBinaryData->WriteChar(ch);
}
}
m_aStates.top().setInternalState(RTFInternalState::NORMAL);
return RTFError::OK;