On Wed, 2012-05-23 at 15:24 +0100, Michael Meeks wrote:
> Off the top of my head this was:
>
> From 93947e85ae1434940aaad516edb60f259b15e950 Mon Sep 17 00:00:00 2001
yeah, the recommended set of patches covered by CVE-2012-1149 is
fe40da4cb640819d869d1c925869bc87ede9bbfe
88e0fa4aa3bea9ffeee372b6a428ca62cee41203
9ff94ae0fa947c5fd6a31fbc38421f60eb5e1fba
Attached is my backport to RHEL-5 OOo, which is 3.1.1 or something like
that. Most likely the attached will apply cleanly for you against 3.2.1
without the hassle of all the changed types and whitespace etc inbetween
C.
diff -ru OOO310_m19/basebmp/source/bitmapdevice.cxx OOO310_m19/basebmp/source/bitmapdevice.cxx
--- OOO310_m19/basebmp/source/bitmapdevice.cxx 2012-05-15 15:55:58.214156464 +0100
+++ OOO310_m19/basebmp/source/bitmapdevice.cxx 2012-05-15 16:15:07.292187024 +0100
@@ -1838,8 +1838,16 @@
// factor in bottom-up scanline order case
nScanlineStride *= bTopDown ? 1 : -1;
- const std::size_t nMemSize(
- (nScanlineStride < 0 ? -nScanlineStride : nScanlineStride)*rSize.getY() );
+ const sal_uInt32 nWidth(nScanlineStride < 0 ? -nScanlineStride : nScanlineStride);
+ const sal_uInt32 nHeight(rSize.getY());
+
+ if (nHeight && nWidth && nWidth > SAL_MAX_INT32 / nHeight)
+ {
+ //suspicious massive alloc
+ return BitmapDeviceSharedPtr();
+ }
+
+ const std::size_t nMemSize(nWidth * nHeight);
if( !pMem )
{
diff -ru OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx
--- OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx 2012-05-15 15:55:57.571148587 +0100
+++ OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx 2012-05-15 16:08:32.869391259 +0100
@@ -344,17 +344,26 @@
// ------------------------------------------------------------------------
-void* JPEGReader::CreateBitmap( void* pParam )
+void* JPEGReader::CreateBitmap( void* _pParam )
{
- Size aSize( ((JPEGCreateBitmapParam*)pParam)->nWidth,
- ((JPEGCreateBitmapParam*)pParam)->nHeight );
- sal_Bool bGray = ((JPEGCreateBitmapParam*)pParam)->bGray != 0;
+ JPEGCreateBitmapParam *pParam = (JPEGCreateBitmapParam *) _pParam;
+
+ if (pParam->nWidth > SAL_MAX_INT32/8 || pParam->nHeight > SAL_MAX_INT32/8)
+ return NULL; // avoid overflows later
+
+ Size aSize( pParam->nWidth, pParam->nHeight );
+ sal_Bool bGray = pParam->bGray != 0;
void* pBmpBuf = NULL;
if( pAcc )
aBmp.ReleaseAccess( pAcc );
+ sal_uInt64 nSize = aSize.Width();
+ nSize *= aSize.Height();
+ if (nSize > SAL_MAX_INT32 / 24)
+ return NULL;
+
if( bGray )
{
BitmapPalette aGrayPal( 256 );
@@ -375,12 +384,11 @@
unsigned long nUnit = ((JPEGCreateBitmapParam*)pParam)->density_unit;
if( ( ( 1 == nUnit ) || ( 2 == nUnit ) ) &&
- ( (JPEGCreateBitmapParam*) pParam )->X_density &&
- ( (JPEGCreateBitmapParam*) pParam )->Y_density )
+ pParam->X_density && pParam->Y_density )
{
Point aEmptyPoint;
- Fraction aFractX( 1, ((JPEGCreateBitmapParam*)pParam)->X_density );
- Fraction aFractY( 1, ((JPEGCreateBitmapParam*)pParam)->Y_density );
+ Fraction aFractX( 1, pParam->X_density );
+ Fraction aFractY( 1, pParam->Y_density );
MapMode aMapMode( nUnit == 1 ? MAP_INCH : MAP_CM, aEmptyPoint, aFractX, aFractY );
Size aPrefSize = OutputDevice::LogicToLogic( aSize, aMapMode, MAP_100TH_MM );
@@ -393,8 +401,6 @@
if( pAcc )
{
- long nAlignedWidth;
-
const ULONG nFormat = pAcc->GetScanlineFormat();
if(
@@ -407,16 +413,15 @@
)
{
pBmpBuf = pAcc->GetBuffer();
- nAlignedWidth = pAcc->GetScanlineSize();
- ((JPEGCreateBitmapParam*)pParam)->bTopDown = pAcc->IsTopDown();
+ pParam->nAlignedWidth = pAcc->GetScanlineSize();
+ pParam->bTopDown = pAcc->IsTopDown();
}
else
{
- nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
- ((JPEGCreateBitmapParam*)pParam)->bTopDown = TRUE;
- pBmpBuf = pBuffer = rtl_allocateMemory( nAlignedWidth * aSize.Height() );
+ pParam->nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
+ pParam->bTopDown = sal_True;
+ pBmpBuf = pBuffer = rtl_allocateMemory( pParam->nAlignedWidth * aSize.Height() );
}
- ((JPEGCreateBitmapParam*)pParam)->nAlignedWidth = nAlignedWidth;
}
return pBmpBuf;
diff -ru OOO310_m19/vcl/source/gdi/pngread.cxx OOO310_m19/vcl/source/gdi/pngread.cxx
--- OOO310_m19/vcl/source/gdi/pngread.cxx 2012-05-15 15:56:04.265230586 +0100
+++ OOO310_m19/vcl/source/gdi/pngread.cxx 2012-05-15 16:17:07.435648183 +0100
@@ -202,6 +202,8 @@
mpScanPrior ( NULL ),
mpTransTab ( NULL ),
mpColorTable ( (sal_uInt8*) mpDefaultColorTable ),
+ mnPass ( 0 ),
+ mbPalette( sal_False ),
mbzCodecInUse ( sal_False ),
mbStatus( TRUE),
mbIDAT( FALSE ),
@@ -304,7 +306,7 @@
nCRC32 = rtl_crc32( nCRC32, &rChunkData.aData[ 0 ], mnChunkLen );
maDataIter = rChunkData.aData.begin();
}
- sal_uInt32 nCheck;
+ sal_uInt32 nCheck(0);
mrPNGStream >> nCheck;
if( nCRC32 != nCheck )
return false;
@@ -370,14 +372,23 @@
// reset to the first chunk
maChunkIter = maChunkSeq.begin();
- // parse the chunks
+ // first chunk must be IDHR
+ if( mbStatus && ReadNextChunk() )
+ {
+ if (mnChunkType == PNGCHUNK_IHDR)
+ mbStatus = ImplReadHeader( rPreviewSizeHint );
+ else
+ mbStatus = false;
+ }
+
+ // parse the remaining chunks
while( mbStatus && !mbIDAT && ReadNextChunk() )
{
switch( mnChunkType )
{
case PNGCHUNK_IHDR :
{
- mbStatus = ImplReadHeader( rPreviewSizeHint );
+ mbStatus = false; //IHDR should only appear as the first chunk
}
break;
@@ -639,14 +650,6 @@
mnScansize = static_cast< sal_uInt32 >( nScansize64 );
- // TODO: switch between both scanlines instead of copying
- mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
- mpScanCurrent = mpInflateInBuf;
- mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
-
- if ( !mpInflateInBuf || !mpScanPrior )
- return FALSE;
-
// calculate target size from original size and the preview hint
if( rPreviewSizeHint.Width() || rPreviewSizeHint.Height() )
{
@@ -681,6 +684,21 @@
maTargetSize.Width() = (maOrigSize.Width() + mnPreviewMask) >> mnPreviewShift;
maTargetSize.Height() = (maOrigSize.Height() + mnPreviewMask) >> mnPreviewShift;
+ //round bits up to nearest multiple of 8 and divide by 8 to get num of bytes per pixel
+ int nBytesPerPixel = ((mnTargetDepth + 7) & ~7)/8;
+
+ //stupidly big, forget about it
+ if (maTargetSize.Width() >= SAL_MAX_INT32 / nBytesPerPixel / maTargetSize.Height())
+ return sal_False;
+
+ // TODO: switch between both scanlines instead of copying
+ mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
+ mpScanCurrent = mpInflateInBuf;
+ mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
+
+ if ( !mpInflateInBuf || !mpScanPrior )
+ return FALSE;
+
mpBmp = new Bitmap( maTargetSize, mnTargetDepth );
mpAcc = mpBmp->AcquireWriteAccess();
if( !mpAcc )
@@ -792,14 +810,17 @@
{
if ( mnChunkLen <= 256 )
{
+ mbTransparent = true;
mpTransTab = new BYTE [ 256 ];
rtl_fillMemory( mpTransTab, 256, 0xff );
- rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
- maDataIter += mnChunkLen;
- mbTransparent = true;
- // need alpha transparency if not on/off masking
- for( int i = 0; i < mnChunkLen; ++i )
- bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
+ if (mnChunkLen > 0)
+ {
+ rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
+ maDataIter += mnChunkLen;
+ // need alpha transparency if not on/off masking
+ for( int i = 0; i < mnChunkLen; ++i )
+ bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
+ }
}
}
break;
_______________________________________________
LibreOffice mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice
