vcl/source/filter/ipdf/pdfdocument.cxx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
New commits: commit 15995c4d464505f6d4e6725901f7678795ec6f74 Author: Stephan Bergmann <[email protected]> AuthorDate: Sat Feb 21 15:59:56 2026 +0100 Commit: Stephan Bergmann <[email protected]> CommitDate: Sat Feb 21 17:10:55 2026 +0100 Fix heap-use-after-free ...as seen during CppunitTest_sd_tiledrendering2, > ==1656617==ERROR: AddressSanitizer: heap-use-after-free on address 0x531000155fe7 at pc 0x55e2bd9ad71d bp 0x7ffde61a2210 sp 0x7ffde61a19d0 > READ of size 177 at 0x531000155fe7 thread T0 > #0 0x55e2bd9ad71c in __asan_memcpy /home/tdf/lode/packages/llvm-llvmorg-18.1.8.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 > #1 0x7f9c90d91bb2 in SvMemoryStream::PutData(void const*, unsigned long) /tools/source/stream/stream.cxx:1578:5 > #2 0x7f9c90d6e77f in SvStream::WriteBytes(void const*, unsigned long) /tools/source/stream/stream.cxx:1195:26 > #3 0x7f9c83b80030 in vcl::filter::PDFDocument::WriteCatalogObject(int, vcl::filter::PDFReferenceElement*&) /vcl/source/filter/ipdf/pdfdocument.cxx:577:27 > > 0x531000155fe7 is located 6119 bytes inside of 65180-byte region [0x531000154800,0x53100016469c) > freed by thread T0 here: > #0 0x55e2bd9faf30 in operator delete[](void*) /home/tdf/lode/packages/llvm-llvmorg-18.1.8.src/compiler-rt/lib/asan/asan_new_delete.cpp:146:3 > #1 0x7f9c90d8f873 in SvMemoryStream::FreeMemory() /tools/source/stream/stream.cxx:1694:9 > #2 0x7f9c90d92f0f in SvMemoryStream::ReAllocateMemory(long) /tools/source/stream/stream.cxx:1671:9 > #3 0x7f9c90d91703 in SvMemoryStream::PutData(void const*, unsigned long) /tools/source/stream/stream.cxx:1569:22 > #4 0x7f9c90d6e77f in SvStream::WriteBytes(void const*, unsigned long) /tools/source/stream/stream.cxx:1195:26 > #5 0x7f9c83b80030 in vcl::filter::PDFDocument::WriteCatalogObject(int, vcl::filter::PDFReferenceElement*&) /vcl/source/filter/ipdf/pdfdocument.cxx:577:27 (<https://ci.libreoffice.org//job/lo_ubsan/3829/>) Change-Id: I38abb9870ffcce3aaf198543e130898817d8fe3e Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199944 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <[email protected]> diff --git a/vcl/source/filter/ipdf/pdfdocument.cxx b/vcl/source/filter/ipdf/pdfdocument.cxx index bce5265de69e..bbb9b84ea5bc 100644 --- a/vcl/source/filter/ipdf/pdfdocument.cxx +++ b/vcl/source/filter/ipdf/pdfdocument.cxx @@ -574,9 +574,10 @@ bool PDFDocument::WriteCatalogObject(sal_Int32 nAnnotId, PDFReferenceElement*& p if (!pAcroFormDictionary) { // No AcroForm key, assume no signatures. - m_aEditBuffer.WriteBytes(static_cast<const char*>(m_aEditBuffer.GetData()) - + pCatalog->GetDictionaryOffset(), - pCatalog->GetDictionaryLength()); + auto const p = static_cast<const char*>(m_aEditBuffer.GetData()) + + pCatalog->GetDictionaryOffset(); + std::vector<char> copy(p, p + pCatalog->GetDictionaryLength()); + m_aEditBuffer.WriteBytes(copy.data(), copy.size()); m_aEditBuffer.WriteOString("/AcroForm<</Fields[ "); m_aEditBuffer.WriteNumberAsString(nAnnotId); m_aEditBuffer.WriteOString(" 0 R ]/SigFlags 3>> ");
