From d9d87d79ced23f8a770eaf94de7e59d59d8eb49e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Thu, 30 Jul 2026 08:00:03 +0000 Subject: [PATCH] ofz: rtf, limit \bin reads to the bytes left in the stream MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I3a1167fe65e9b3e86502707fa796c21b2846a6e8 Signed-off-by: Caolán McNamara Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8142 Tested-by: Jenkins CPCI Reviewed-by: Noel Grandin (cherry picked from commit 72f836bfd346ca5d62a1f9bc2f3c3d5d4cd87b8c) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208840 Reviewed-by: Xisco Fauli Tested-by: Jenkins --- .../writerfilter/rtftok/rtfdocumentimpl.cxx | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx b/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx index 4f93999b1745..3ef9c347c4a5 100644 --- a/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx +++ b/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx @@ -1317,10 +1317,20 @@ RTFError RTFDocumentImpl::resolveChars(char ch) { m_pBinaryData = std::make_shared(); m_pBinaryData->WriteChar(ch); - for (int i = 0; i < m_aStates.top().getBinaryToRead() - 1; ++i) + const int nBinaryToRead = m_aStates.top().getBinaryToRead(); + SAL_WARN_IF(nBinaryToRead < 0, "writerfilter.rtf", + "negative \\bin length of " << nBinaryToRead); + if (nBinaryToRead > 1) { - Strm().ReadChar(ch); - m_pBinaryData->WriteChar(ch); + const sal_uInt64 nWanted = nBinaryToRead - 1; + const sal_uInt64 nCount = std::min(nWanted, Strm().remainingSize()); + SAL_WARN_IF(nCount < nWanted, "writerfilter.rtf", + "\\bin asks for " << nWanted << " bytes with only " << nCount << " left"); + for (sal_uInt64 i = 0; i < nCount; ++i) + { + Strm().ReadChar(ch); + m_pBinaryData->WriteChar(ch); + } } m_aStates.top().setInternalState(RTFInternalState::NORMAL); return RTFError::OK;