You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by ji...@apache.org on 2026/09/24 20:49:25 UTC
(openoffice) branch AOO50X updated: svtools: check the WMF private-escape text length and advance array
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
The following commit(s) were added to refs/heads/AOO50X by this push:
new 77e27ba963 svtools: check the WMF private-escape text length and advance array
77e27ba963 is described below
commit 77e27ba963f99fa7ac0a8c7dab9d2f142b0b06f4
Author: Peter Kovacs <pe...@apache.org>
AuthorDate: Sun Aug 30 01:44:53 2026 +0200
svtools: check the WMF private-escape text length and advance array
Limit the character count of a PRIVATE_ESCAPE_UNICODE record to what a
String can hold, and ignore an advance array that has fewer entries than
the text has characters, as if it were missing.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
main/svtools/source/filter/wmf/winwmf.cxx | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/main/svtools/source/filter/wmf/winwmf.cxx b/main/svtools/source/filter/wmf/winwmf.cxx
index 94f28877a3..8827051d11 100644
--- a/main/svtools/source/filter/wmf/winwmf.cxx
+++ b/main/svtools/source/filter/wmf/winwmf.cxx
@@ -898,6 +898,10 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
>> aPt.Y()
>> nStringLen;
+ // AllocBuffer takes an xub_StrLen
+ if ( nStringLen >= STRING_MAXLEN )
+ break;
+
if ( ( static_cast< sal_uInt64 >( nStringLen ) * sizeof( sal_Unicode ) ) < ( nEscLen - aMemoryStream.Tell() ) )
{
sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
@@ -906,6 +910,9 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
aMemoryStream >> nDXCount;
if ( ( static_cast< sal_uInt64 >( nDXCount ) * sizeof( sal_Int32 ) ) >= ( nEscLen - aMemoryStream.Tell() ) )
nDXCount = 0;
+ // one advance per character; ignore a shorter array
+ if ( nDXCount && ( nDXCount < nStringLen ) )
+ nDXCount = 0;
if ( nDXCount )
pDXAry = new sal_Int32[ nDXCount ];
for ( i = 0; i < nDXCount; i++ )