rpms/openoffice.org/FC-6 openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch, NONE, 1.1 openoffice.org.spec, 1.912, 1.913

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Mon Dec 4 11:09:21 UTC 2006 

Author: caolanm

Update of /cvs/dist/rpms/openoffice.org/FC-6
In directory cvs.devel.redhat.com:/tmp/cvs-serv5881

Modified Files:
	openoffice.org.spec 
Added Files:
	openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch 
Log Message:
rhbz#217347 openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch

openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch:
 enhwmf.cxx |   85 +++++++++++++++++++++++++++++++++----------------------------
 winwmf.cxx |   26 ++++++++++--------
 2 files changed, 61 insertions(+), 50 deletions(-)

--- NEW FILE openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch ---
diff -ru svtools/source/filter.vcl/wmf/enhwmf.cxx svtools/source/filter.vcl/wmf/enhwmf.cxx
--- openoffice.org.orig/svtools/source/filter.vcl/wmf/enhwmf.cxx	2006-11-27 07:02:23.000000000 -0500
+++ openoffice.org/svtools/source/filter.vcl/wmf/enhwmf.cxx	2006-11-27 07:06:51.000000000 -0500
@@ -385,33 +387,37 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
 
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-
-				for ( i = 0; i < nPoly; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
 
-				for ( i = 0; i < nGesPoints; i++ )
-				{
-					*pWMF >> nX32 >> nY32;
-					pPtAry[ i ] = Point( nX32, nY32 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+	
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+	
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX32 >> nY32;
+						pPtAry[ i ] = Point( nX32, nY32 );
+					}
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
 			}
 			break;
 
@@ -1137,31 +1143,34 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-				for ( i = 0; i < nPoly; i++ )
-				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
-				for ( i = 0; i < nGesPoints; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nX16 >> nY16;
-					pPtAry[ i ] = Point( nX16, nY16 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX16 >> nY16;
+						pPtAry[ i ] = Point( nX16, nY16 );
+					}
+	
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
-			};
+			}
 			break;
 
 			case EMR_FILLRGN :
diff -ru svtools/source/filter.vcl/wmf/winwmf.cxx svtools/source/filter.vcl/wmf/winwmf.cxx
--- openoffice.org.orig/svtools/source/filter.vcl/wmf/winwmf.cxx	2006-11-27 07:02:23.000000000 -0500
+++ openoffice.org/svtools/source/filter.vcl/wmf/winwmf.cxx	2006-11-27 07:05:30.000000000 -0500
@@ -874,17 +874,21 @@
 										aMemoryStream >> aPt.X()
 													  >> aPt.Y()
 													  >> nStringLen;
-										sal_Unicode* pBuf = aString.AllocBuffer( (sal_uInt16)nStringLen );
-										for ( i = 0; i < nStringLen; i++ )
-											aMemoryStream >> pBuf[ i ];
-										aMemoryStream >> nDXCount;
-										if ( nDXCount )
-											pDXAry = new sal_Int32[ nDXCount ];
-										for  ( i = 0; i < nDXCount; i++ )
-											aMemoryStream >> pDXAry[ i ];
-										aMemoryStream >> nSkipActions;
-										pOut->DrawText( aPt, aString, pDXAry );
-										delete[] pDXAry;
+
+										if (nStringLen < STRING_MAXLEN)
+										{
+											sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
+											for ( i = 0; i < nStringLen; i++ )
+												aMemoryStream >> pBuf[ i ];
+											aMemoryStream >> nDXCount;
+											if ( nDXCount )
+												pDXAry = new sal_Int32[ nDXCount ];
+											for  ( i = 0; i < nDXCount; i++ )
+												aMemoryStream >> pDXAry[ i ];
+											aMemoryStream >> nSkipActions;
+											pOut->DrawText( aPt, aString, pDXAry );
+											delete[] pDXAry;
+										}
 									}
 								}
 								break;


Index: openoffice.org.spec
===================================================================
RCS file: /cvs/dist/rpms/openoffice.org/FC-6/openoffice.org.spec,v
retrieving revision 1.912
retrieving revision 1.913
diff -u -r1.912 -r1.913
--- openoffice.org.spec	29 Nov 2006 11:21:50 -0000	1.912
+++ openoffice.org.spec	4 Dec 2006 11:09:18 -0000	1.913
@@ -148,6 +148,7 @@
 Patch80: openoffice.org-2.0.3.rh127576.gtkunixprintdialog.localize
 Patch81: openoffice.org-2.1.0.ooo71815.bridges.x86_64.patch
 Patch82: openoffice.org-2.1.0.rh217269.officecfg.nosequencecheck.patch
+Patch83: openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch
 
 %define instdir %{_libdir}/openoffice.org2.0
 
@@ -1030,6 +1031,7 @@
 cat %{PATCH80} >> svtools/source/dialogs/localize.sdf
 %patch81 -p1 -b .ooo71815.bridges.x86_64.patch
 %patch82 -p1 -b .rh217269.officecfg.nosequencecheck.patch
+%patch83 -p1 -b .ooo70042.wmfoverflow.svtools.patch
 
 tar xzf %{SOURCE1}
 
@@ -2558,6 +2560,7 @@
 * Wed Nov 28 2006 Caolan McNamara <caolanm at redhat.com> - 1:2.0.4-5.5.7
 - Resolves: rhbz#217361 wrong libjvm on ppc32/ppc64 multiarch installed libgcj's
 - Resolves: rhbz#217269/rhbz#190515/rhbz#212134 disable sequence by default
+- Resolves: rhbz#217347 openoffice.org-2.1.0.ooo70042.wmfoverflow.svtools.patch
 
 * Thu Nov 23 2006 Caolan McNamara <caolanm at redhat.com> - 1:2.0.4-5.5.6
 - Resolves: rhbz#217047

More information about the fedora-cvs-commits mailing list