filter/source/svg/svgwriter.cxx | 9 ++++++++- vcl/source/filter/svm/SvmReader.cxx | 11 ++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-)
New commits: commit 0ea5dde060df7ef638fbd1f2efe6aa221033e69c Author: Caolán McNamara <[email protected]> AuthorDate: Tue Jun 13 14:45:59 2023 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Tue Jun 13 17:11:24 2023 +0200 cid#1532379 Untrusted loop bound and cid#1532378 Untrusted loop bound Change-Id: I06f9267f02a6f41559d617c1a43671d4a8234350 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152964 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/filter/source/svg/svgwriter.cxx b/filter/source/svg/svgwriter.cxx index bb9f39dd8d19..be95c89de895 100644 --- a/filter/source/svg/svgwriter.cxx +++ b/filter/source/svg/svgwriter.cxx @@ -3393,10 +3393,17 @@ void SVGActionWriter::ImplWriteActions( const GDIMetaFile& rMtf, basegfx::BColorStops aColorStops; SvMemoryStream aMemStm(const_cast<sal_uInt8 *>(pA->GetData()), pA->GetDataSize(), StreamMode::READ); VersionCompatRead aCompat(aMemStm); - sal_uInt16 nTmp; + sal_uInt16 nTmp(0); double fOff, fR, fG, fB; aMemStm.ReadUInt16( nTmp ); + const size_t nMaxPossibleEntries = aMemStm.remainingSize() / 4 * sizeof(double); + if (nTmp > nMaxPossibleEntries) + { + SAL_WARN("filter.svg", "gradiant record claims to have: " << nTmp << " entries, but only " << nMaxPossibleEntries << " possible, clamping"); + nTmp = nMaxPossibleEntries; + } + for (sal_uInt16 a(0); a < nTmp; a++) { aMemStm.ReadDouble(fOff); diff --git a/vcl/source/filter/svm/SvmReader.cxx b/vcl/source/filter/svm/SvmReader.cxx index 4ec9ec0a3d2e..20462b620da5 100644 --- a/vcl/source/filter/svm/SvmReader.cxx +++ b/vcl/source/filter/svm/SvmReader.cxx @@ -1340,10 +1340,19 @@ rtl::Reference<MetaAction> SvmReader::FloatTransparentHandler(ImplMetaReadData* if (aCompat.GetVersion() > 1) { basegfx::BColorStops aColorStops; - sal_uInt16 nTmp; + sal_uInt16 nTmp(0); double fOff, fR, fG, fB; mrStream.ReadUInt16(nTmp); + const size_t nMaxPossibleEntries = mrStream.remainingSize() / 4 * sizeof(double); + if (nTmp > nMaxPossibleEntries) + { + SAL_WARN("vcl.gdi", "gradiant record claims to have: " << nTmp << " entries, but only " + << nMaxPossibleEntries + << " possible, clamping"); + nTmp = nMaxPossibleEntries; + } + for (sal_uInt16 a(0); a < nTmp; a++) { mrStream.ReadDouble(fOff);
