include/svx/sdasitm.hxx | 22 ++-------------------- svx/source/items/customshapeitem.cxx | 31 ++++++++++++++++++++++++++++++- 2 files changed, 32 insertions(+), 21 deletions(-)
New commits: commit 7fcbb29db802acd8c0f32e8ff578ef4b2f82c46b Author: Michael Stahl <[email protected]> Date: Sat Nov 22 00:21:19 2014 +0100 svx: punish evil-doers who put duplicate properties into custom shapes LO 4.3.2.2 is evidently able to export an ODF document that violates XML Well-formedness constraint: Unique Att Spec. <draw:enhanced-geometry draw:mirror-horizontal="false" draw:mirror-vertical="false" svg:viewBox="0 0 21679 2134682997" draw:text-areas="0 0 ?f3 ?f2" draw:mirror-vertical="true" draw:type="ooxml-rect" draw:enhanced-path="M 0 0 L ?f3 0 ?f3 ?f2 0 ?f2 Z N"> Not sure how to reproduce this, but the attributes there are apparently a serialization of SdrCustomShapeGeometryItem's aPropSeq, retrieved from a "CustomShapeGeometry" property, so add some input validation and assertions there. Change-Id: I91151365b507779a4bdc9cce2057d34f2376f005 diff --git a/svx/source/items/customshapeitem.cxx b/svx/source/items/customshapeitem.cxx index eae790d..cb6e1fa 100644 --- a/svx/source/items/customshapeitem.cxx +++ b/svx/source/items/customshapeitem.cxx @@ -46,7 +46,14 @@ SdrCustomShapeGeometryItem::SdrCustomShapeGeometryItem( const uno::Sequence< bea for ( i = 0; i < aPropSeq.getLength(); i++ ) { beans::PropertyValue& rPropVal = aPropSeq[ i ]; - aPropHashMap[ rPropVal.Name ] = i; + std::pair<PropertyHashMap::iterator, bool> const ret( + aPropHashMap.insert(std::make_pair(rPropVal.Name, i))); + assert(ret.second); // serious bug: duplicate xml attribute exported + if (!ret.second) + { + throw uno::RuntimeException( + "CustomShapeGeometry has duplicate property " + rPropVal.Name); + } if ( rPropVal.Value.getValueType() == ::getCppuType((const ::com::sun::star::uno::Sequence < beans::PropertyValue >*)0) ) { uno::Sequence< beans::PropertyValue >& rPropSeq = *( uno::Sequence< beans::PropertyValue >*)rPropVal.Value.getValue(); @@ -148,6 +155,9 @@ void SdrCustomShapeGeometryItem::SetPropertyValue( const com::sun::star::beans:: } else { // it's a new property + assert(aPropSeq.end() == std::find_if(aPropSeq.begin(), aPropSeq.end(), + [&rPropVal](beans::PropertyValue const& rVal) + { return rVal.Name == rPropVal.Name; } )); sal_uInt32 nIndex = aPropSeq.getLength(); aPropSeq.realloc( nIndex + 1 ); aPropSeq[ nIndex ] = rPropVal ; @@ -171,6 +181,9 @@ void SdrCustomShapeGeometryItem::SetPropertyValue( const OUString& rSequenceName aValue.Name = rSequenceName; aValue.Value = ::com::sun::star::uno::makeAny( aSeq ); + assert(aPropSeq.end() == std::find_if(aPropSeq.begin(), aPropSeq.end(), + [&rSequenceName](beans::PropertyValue const& rV) + { return rV.Name == rSequenceName; } )); sal_uInt32 nIndex = aPropSeq.getLength(); aPropSeq.realloc( nIndex + 1 ); aPropSeq[ nIndex ] = aValue; @@ -316,7 +329,23 @@ bool SdrCustomShapeGeometryItem::PutValue( const uno::Any& rVal, sal_uInt8 /*nMe if ( ! ( rVal >>= aPropSeq ) ) return false; else + { + for (sal_Int32 i = 0; i < aPropSeq.getLength(); ++i) + { + for (sal_Int32 j = i+1; j < aPropSeq.getLength(); ++j) + { + if (aPropSeq[i].Name == aPropSeq[j].Name) + { + assert(0); // serious bug: duplicate xml attribute exported + OUString const name(aPropSeq[i].Name); + aPropSeq.realloc(0); + throw uno::RuntimeException( + "CustomShapeGeometry has duplicate property " + name); + } + } + } return true; + } } SdrCustomShapeReplacementURLItem::SdrCustomShapeReplacementURLItem() commit df3c5583a0354a0110df033145c05b1fd08e9582 Author: Michael Stahl <[email protected]> Date: Fri Nov 21 23:42:21 2014 +0100 svx: remove some pointless default implemented operator== structs Change-Id: I792af21b0164fed4b2e22a1f95c3898ec631a25b diff --git a/include/svx/sdasitm.hxx b/include/svx/sdasitm.hxx index 5255bcd..6ecb277 100644 --- a/include/svx/sdasitm.hxx +++ b/include/svx/sdasitm.hxx @@ -49,20 +49,12 @@ public: typedef std::pair < const OUString, const OUString > PropertyPair; private: - struct SVX_DLLPUBLIC PropertyEq - { - bool operator()( const OUString&, const OUString& ) const; - }; - struct SVX_DLLPUBLIC PropertyPairEq - { - bool operator()( const SdrCustomShapeGeometryItem::PropertyPair&, const SdrCustomShapeGeometryItem::PropertyPair& ) const; - }; struct SVX_DLLPUBLIC PropertyPairHash { size_t operator()( const SdrCustomShapeGeometryItem::PropertyPair& ) const; }; - typedef boost::unordered_map < PropertyPair, sal_Int32, PropertyPairHash, PropertyPairEq > PropertyPairHashMap; - typedef boost::unordered_map< OUString, sal_Int32, OUStringHash, PropertyEq > PropertyHashMap; + typedef boost::unordered_map <PropertyPair, sal_Int32, PropertyPairHash> PropertyPairHashMap; + typedef boost::unordered_map<OUString, sal_Int32, OUStringHash> PropertyHashMap; PropertyHashMap aPropHashMap; PropertyPairHashMap aPropPairHashMap; @@ -121,16 +113,6 @@ inline SdrOnOffItem makeSdrTextAutoGrowSizeItem( bool bAuto ) { // some useful inline methods -inline bool SdrCustomShapeGeometryItem::PropertyEq::operator()( const OUString& r1, const OUString& r2 ) const -{ - return r1.equals( r2 ); -} - -inline bool SdrCustomShapeGeometryItem::PropertyPairEq::operator()( const SdrCustomShapeGeometryItem::PropertyPair& r1, const SdrCustomShapeGeometryItem::PropertyPair& r2 ) const -{ - return ( r1.first.equals( r2.first ) ) && ( r1.second.equals( r2.second ) ); -} - inline size_t SdrCustomShapeGeometryItem::PropertyPairHash::operator()( const SdrCustomShapeGeometryItem::PropertyPair &r1 ) const { return (size_t)r1.first.hashCode() + r1.second.hashCode(); _______________________________________________ Libreoffice-commits mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
