filter/source/graphicfilter/ieps/ieps.cxx | 24 +++++++++++------------- svtools/source/graphic/grfmgr2.cxx | 18 +++++++----------- 2 files changed, 18 insertions(+), 24 deletions(-)
New commits: commit d1f31681623696e99b0bd9e98570cb1ebac518cc Author: Caolán McNamara <[email protected]> Date: Fri Jan 27 08:58:51 2017 +0000 ofz: check if the stream is able to meet the eps len claim before reading Change-Id: I440c7f38d6588c570a411f2a97c0164e5d7d646f diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index 090bc65..2a8f900 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -399,6 +399,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic); } +namespace +{ + bool checkSeek(SvStream &rSt, sal_uInt32 nOffset) + { + const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize()); + return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset); + } +} + // this method adds a replacement action containing the original wmf or tiff replacement, // so the original eps can be written when storing to ODF. void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize, @@ -416,17 +425,15 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize ) .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF ) .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF ); - if ( nSizeWMF ) + if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF) { std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]); - rStrm.Seek( nOrigPos + nPosWMF ); rStrm.ReadBytes(pBuf.get(), nSizeWMF); aReplacement.WriteBytes(pBuf.get(), nSizeWMF); } - if ( nSizeTIFF ) + if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF) { std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]); - rStrm.Seek( nOrigPos + nPosTIFF ); rStrm.ReadBytes(pBuf.get(), nSizeTIFF); aReplacement.WriteBytes(pBuf.get(), nSizeTIFF); } @@ -519,15 +526,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead, rGraphic = aMtf; } -namespace -{ - bool checkSeek(SvStream &rSt, sal_uInt32 nOffset) - { - const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize()); - return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset); - } -} - //================== GraphicImport - the exported function ================ commit b602313ab871da31da4ca3a25cc2f84c12efb65e Author: Caolán McNamara <[email protected]> Date: Thu Jan 26 21:29:59 2017 +0000 tweak the scoping here a little Change-Id: Idb257e3aee7d3f0316f34d34866eb2484390a798 diff --git a/svtools/source/graphic/grfmgr2.cxx b/svtools/source/graphic/grfmgr2.cxx index f71c67a..7ef820e 100644 --- a/svtools/source/graphic/grfmgr2.cxx +++ b/svtools/source/graphic/grfmgr2.cxx @@ -1723,10 +1723,6 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent // been generated ImplTileInfo aTileInfo; - // current output position while drawing - Point aCurrPos; - int nX, nY; - // check for recursion's end condition: LSB place reached? if( nMSBFactor == 1 ) { @@ -1768,9 +1764,9 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent { // now fill one row from aTileInfo.aNextTileTopLeft.X() all // the way to the right - aCurrPos.X() = aTileInfo.aNextTileTopLeft.X(); - aCurrPos.Y() = aTileInfo.aTileTopLeft.Y(); - for( nX=0; nX < aTileInfo.nTilesEmptyX; nX += nMSBFactor ) + // current output position while drawing + Point aCurrPos(aTileInfo.aNextTileTopLeft.X(), aTileInfo.aTileTopLeft.Y()); + for (int nX=0; nX < aTileInfo.nTilesEmptyX; nX += nMSBFactor) { if( !aTmpGraphic.Draw( &rVDev, aCurrPos, aTileInfo.aTileSizePixel, pAttr, nFlags ) ) return false; @@ -1791,7 +1787,7 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent // the way to the bottom aCurrPos.X() = aTileInfo.aTileTopLeft.X(); aCurrPos.Y() = aTileInfo.aNextTileTopLeft.Y(); - for( nY=0; nY < aTileInfo.nTilesEmptyY; nY += nMSBFactor ) + for (int nY=0; nY < aTileInfo.nTilesEmptyY; nY += nMSBFactor) { if( !aTmpGraphic.Draw( &rVDev, aCurrPos, aTileInfo.aTileSizePixel, pAttr, nFlags ) ) return false; @@ -1838,18 +1834,18 @@ bool GraphicObject::ImplRenderTileRecursive( VirtualDevice& rVDev, int nExponent rTileInfo.nTilesEmptyY = aTileInfo.nTilesEmptyY - nRemainderTilesY; // init output position - aCurrPos = aTileInfo.aNextTileTopLeft; + Point aCurrPos = aTileInfo.aNextTileTopLeft; // fill our drawing area. Fill possibly more, to create the next // bigger tile size -> see bitmap extraction above. This does no // harm, since everything right or below our actual area is // overdrawn by our caller. Just in case we're in the last level, // we don't draw beyond the right or bottom border. - for( nY=0; nY < aTileInfo.nTilesEmptyY && nY < nExponent*nMSBFactor; nY += nMSBFactor ) + for (int nY=0; nY < aTileInfo.nTilesEmptyY && nY < nExponent*nMSBFactor; nY += nMSBFactor) { aCurrPos.X() = aTileInfo.aNextTileTopLeft.X(); - for( nX=0; nX < aTileInfo.nTilesEmptyX && nX < nExponent*nMSBFactor; nX += nMSBFactor ) + for (int nX=0; nX < aTileInfo.nTilesEmptyX && nX < nExponent*nMSBFactor; nX += nMSBFactor) { if( bNoFirstTileDraw ) bNoFirstTileDraw = false; // don't draw first tile position
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
