libwpd/libwpd-0.8.8.diff

   1 *** misc/libwpd-0.8.8/configure Tue Jan  9 10:35:10 2007
   2 --- misc/build/libwpd-0.8.8/configure   Thu Feb 21 11:37:54 2008
   3 ***************
   4 *** 8089,8095 ****
   5     ;;
   6
   7   freebsd*)
   8 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo aout`
   9     version_type=freebsd-$objformat
  10     case $version_type in
  11       freebsd-elf*)
  12 --- 8089,8095 ----
  13     ;;
  14
  15   freebsd*)
  16 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
  17     version_type=freebsd-$objformat
  18     case $version_type in
  19       freebsd-elf*)
  20 ***************
  21 *** 11808,11814 ****
  22     ;;
  23
  24   freebsd*)
  25 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo aout`
  26     version_type=freebsd-$objformat
  27     case $version_type in
  28       freebsd-elf*)
  29 --- 11808,11814 ----
  30     ;;
  31
  32   freebsd*)
  33 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
  34     version_type=freebsd-$objformat
  35     case $version_type in
  36       freebsd-elf*)
  37 ***************
  38 *** 14978,14984 ****
  39     ;;
  40
  41   freebsd*)
  42 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo aout`
  43     version_type=freebsd-$objformat
  44     case $version_type in
  45       freebsd-elf*)
  46 --- 14978,14984 ----
  47     ;;
  48
  49   freebsd*)
  50 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
  51     version_type=freebsd-$objformat
  52     case $version_type in
  53       freebsd-elf*)
  54 ***************
  55 *** 17346,17352 ****
  56     ;;
  57
  58   freebsd*)
  59 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo aout`
  60     version_type=freebsd-$objformat
  61     case $version_type in
  62       freebsd-elf*)
  63 --- 17346,17352 ----
  64     ;;
  65
  66   freebsd*)
  67 !   objformat=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
  68     version_type=freebsd-$objformat
  69     case $version_type in
  70       freebsd-elf*)
  71 *** misc/libwpd-0.8.8/src/lib/WP1Heuristics.cpp Wed Jan  3 13:07:55 2007
  72 --- misc/build/libwpd-0.8.8/src/lib/WP1Heuristics.cpp   Thu Feb 21 11:37:54 2008
  73 ***************
  74 *** 27,32 ****
  75 --- 27,33 ----
  76   #include "WP1Heuristics.h"
  77   #include "WP1FileStructure.h"
  78   #include "libwpd_internal.h"
  79 + #include <limits>
  80
  81   WPDConfidence WP1Heuristics::isWP1FileFormat(WPXInputStream *input, bool partialContent)
  82   {
  83 ***************
  84 *** 74,81 ****
  85                                 //   <function code>{function length}...{function length}<function code>
  86                                 //   that we observed in variable length WP1 functions
  87
  88 !                               long functionLength = readU32(input, true);
  89 !                               long closingFunctionLength = 0;
  90                                 WPD_DEBUG_MSG(("WP1Heuristics functionLength = 0x%.8x\n", (unsigned int)functionLength));
  91
  92                                 input->seek(functionLength, WPX_SEEK_CUR);
  93 --- 75,84 ----
  94                                 //   <function code>{function length}...{function length}<function code>
  95                                 //   that we observed in variable length WP1 functions
  96
  97 !                               unsigned long functionLength = readU32(input, true);
  98 !                               if (functionLength > ((std::numeric_limits<uint32_t>::max)() / 2))
  99 !                                       return WPD_CONFIDENCE_NONE;
 100 !                               unsigned long closingFunctionLength = 0;
 101                                 WPD_DEBUG_MSG(("WP1Heuristics functionLength = 0x%.8x\n", (unsigned int)functionLength));
 102
 103                                 input->seek(functionLength, WPX_SEEK_CUR);
 104 *** misc/libwpd-0.8.8/src/lib/WP1Part.cpp       Wed Jan  3 13:07:55 2007
 105 --- misc/build/libwpd-0.8.8/src/lib/WP1Part.cpp Thu Feb 21 11:37:54 2008
 106 ***************
 107 *** 46,51 ****
 108 --- 46,58 ----
 109         }
 110         else if (WP1_FUNCTION_GROUP_SIZE[readVal-0xC0] == -1)
 111         {
 112 +               // Should not happen because the heuristics would not recognize this file as a well formed WP1 file,
 113 +               // Nonetheless if we ever change the parts using the heuristics, this will be a check useful to have
 114 +               if (!WP1VariableLengthGroup::isGroupConsistent(input, readVal))
 115 +               {
 116 +                       WPD_DEBUG_MSG(("WordPerfect: Consistency Check (variable length) failed; ignoring this byte\n"));
 117 +                       return 0;
 118 +               }
 119                 WPD_DEBUG_MSG(("WordPerfect: constructVariableLengthGroup\n"));
 120                 return WP1VariableLengthGroup::constructVariableLengthGroup(input, readVal);
 121         }
 122 *** misc/libwpd-0.8.8/src/lib/WP1SetTabsGroup.cpp       Fri Jan  5 10:21:16 2007
 123 --- misc/build/libwpd-0.8.8/src/lib/WP1SetTabsGroup.cpp Thu Feb 21 11:37:54 2008
 124 ***************
 125 *** 39,45 ****
 126   void WP1SetTabsGroup::_readContents(WPXInputStream *input)
 127   {
 128         // Skip first the old condensed tab table
 129 !       while (readU8(input) != 0xff)
 130                 input->seek(2, WPX_SEEK_CUR);
 131
 132         // Now read the new condensed tab table
 133 --- 39,45 ----
 134   void WP1SetTabsGroup::_readContents(WPXInputStream *input)
 135   {
 136         // Skip first the old condensed tab table
 137 !       while (readU8(input) != 0xff && !input->atEOS())
 138                 input->seek(2, WPX_SEEK_CUR);
 139
 140         // Now read the new condensed tab table
 141 ***************
 142 *** 47,54 ****
 143         float tmpTabPosition = 0.0f;
 144         WPXTabStop tmpTabStop = WPXTabStop();
 145
 146 !       while ((tmpTabType = read8(input)) & 0xff != 0xff)
 147         {
 148                 tmpTabPosition = (float)((double)readU16(input, true) / 72.0f);
 149
 150                 if (tmpTabType < 0)
 151 --- 47,56 ----
 152         float tmpTabPosition = 0.0f;
 153         WPXTabStop tmpTabStop = WPXTabStop();
 154
 155 !       while (((tmpTabType = read8(input)) & 0xff) != 0xff)
 156         {
 157 +               if (input->atEOS())
 158 +                       throw FileException();
 159                 tmpTabPosition = (float)((double)readU16(input, true) / 72.0f);
 160
 161                 if (tmpTabType < 0)
 162 *** misc/libwpd-0.8.8/src/lib/WP1SubDocument.cpp        Wed Jan  3 13:07:55 2007
 163 --- misc/build/libwpd-0.8.8/src/lib/WP1SubDocument.cpp  Thu Feb 21 11:37:54 2008
 164 ***************
 165 *** 26,32 ****
 166   #include "WP1Parser.h"
 167   #include "libwpd_internal.h"
 168
 169 ! WP1SubDocument::WP1SubDocument(WPXInputStream *input, const int dataSize) :
 170         WPXSubDocument(input, dataSize)
 171   {
 172   }
 173 --- 26,32 ----
 174   #include "WP1Parser.h"
 175   #include "libwpd_internal.h"
 176
 177 ! WP1SubDocument::WP1SubDocument(WPXInputStream *input, const unsigned dataSize) :
 178         WPXSubDocument(input, dataSize)
 179   {
 180   }
 181 *** misc/libwpd-0.8.8/src/lib/WP1SubDocument.h  Wed Jan  3 13:07:56 2007
 182 --- misc/build/libwpd-0.8.8/src/lib/WP1SubDocument.h    Thu Feb 21 11:37:54 2008
 183 ***************
 184 *** 32,38 ****
 185   class WP1SubDocument : public WPXSubDocument
 186   {
 187   public:
 188 !       WP1SubDocument(WPXInputStream *input, const int dataSize);
 189         void parse(WP1Listener *listener) const;
 190
 191   };
 192 --- 32,38 ----
 193   class WP1SubDocument : public WPXSubDocument
 194   {
 195   public:
 196 !       WP1SubDocument(WPXInputStream *input, const unsigned dataSize);
 197         void parse(WP1Listener *listener) const;
 198
 199   };
 200 *** misc/libwpd-0.8.8/src/lib/WP1VariableLengthGroup.cpp        Wed Jan  3 13:07:55 2007
 201 --- misc/build/libwpd-0.8.8/src/lib/WP1VariableLengthGroup.cpp  Thu Feb 21 11:37:54 2008
 202 ***************
 203 *** 31,36 ****
 204 --- 31,37 ----
 205   #include "WP1FootnoteEndnoteGroup.h"
 206   #include "WP1FileStructure.h"
 207   #include "libwpd_internal.h"
 208 + #include <limits>
 209
 210   WP1VariableLengthGroup::WP1VariableLengthGroup(uint8_t group)
 211         : m_group(group)
 212 ***************
 213 *** 60,65 ****
 214 --- 61,68 ----
 215         try
 216         {
 217                 uint32_t size = readU32(input, true);
 218 +               if (size > ((std::numeric_limits<uint32_t>::max)() / 2))
 219 +                       return false;
 220
 221                 if (input->seek(size, WPX_SEEK_CUR) || input->atEOS())
 222                 {
 223 ***************
 224 *** 94,104 ****
 225 --- 97,114 ----
 226         WPD_DEBUG_MSG(("WordPerfect: handling a variable length group\n"));
 227
 228         m_size = readU32(input, true); // the length is the number of data bytes minus 4 (ie. the function codes)
 229 +
 230 +       if (m_size + startPosition < startPosition)
 231 +               throw FileException();
 232
 233         WPD_DEBUG_MSG(("WordPerfect: Read variable group header (start_position: %i, size: %i)\n", startPosition, m_size));
 234
 235         _readContents(input);
 236
 237 +       if ((m_size + startPosition + 4 < m_size + startPosition) ||
 238 +               (m_size + startPosition + 4) > ((std::numeric_limits<uint32_t>::max)() / 2))
 239 +               throw FileException();
 240 +
 241         input->seek(startPosition + m_size + 4, WPX_SEEK_SET);
 242
 243         if (m_size != readU32(input, true))
 244 ***************
 245 *** 112,117 ****
 246 --- 122,130 ----
 247                 throw FileException();
 248         }
 249
 250 +       if ((m_size + startPosition + 9 < m_size + startPosition) ||
 251 +               (m_size + startPosition + 9) > ((std::numeric_limits<uint32_t>::max)() / 2))
 252 +               throw FileException();
 253         input->seek(startPosition + m_size + 9, WPX_SEEK_SET);
 254
 255   }
 256 *** misc/libwpd-0.8.8/src/lib/WP3PageFormatGroup.cpp    Fri Jan  5 10:21:13 2007
 257 --- misc/build/libwpd-0.8.8/src/lib/WP3PageFormatGroup.cpp      Thu Feb 21 11:37:54 2008
 258 ***************
 259 *** 91,98 ****
 260
 261                 m_isRelative = (readU8(input) & 0x01);
 262
 263 !               while ((tmpTabType = read8(input)) & 0xff != 0xff)
 264                 {
 265                         tmpTabPosition = fixedPointToFloat(readU32(input, true)) / 72.0f;
 266
 267                         if (tmpTabType < 0)
 268 --- 91,100 ----
 269
 270                 m_isRelative = (readU8(input) & 0x01);
 271
 272 !               while (((tmpTabType = read8(input)) & 0xff) != 0xff)
 273                 {
 274 +                       if (input->atEOS())
 275 +                               throw FileException();
 276                         tmpTabPosition = fixedPointToFloat(readU32(input, true)) / 72.0f;
 277
 278                         if (tmpTabType < 0)
 279 *** misc/libwpd-0.8.8/src/lib/WP3SubDocument.cpp        Wed Jan  3 13:07:55 2007
 280 --- misc/build/libwpd-0.8.8/src/lib/WP3SubDocument.cpp  Thu Feb 21 11:37:54 2008
 281 ***************
 282 *** 26,32 ****
 283   #include "WP3Parser.h"
 284   #include "libwpd_internal.h"
 285
 286 ! WP3SubDocument::WP3SubDocument(WPXInputStream *input, const int dataSize) :
 287         WPXSubDocument(input, dataSize)
 288   {
 289   }
 290 --- 26,32 ----
 291   #include "WP3Parser.h"
 292   #include "libwpd_internal.h"
 293
 294 ! WP3SubDocument::WP3SubDocument(WPXInputStream *input, const unsigned dataSize) :
 295         WPXSubDocument(input, dataSize)
 296   {
 297   }
 298 *** misc/libwpd-0.8.8/src/lib/WP3SubDocument.h  Wed Jan  3 13:07:56 2007
 299 --- misc/build/libwpd-0.8.8/src/lib/WP3SubDocument.h    Thu Feb 21 11:37:54 2008
 300 ***************
 301 *** 32,38 ****
 302   class WP3SubDocument : public WPXSubDocument
 303   {
 304   public:
 305 !       WP3SubDocument(WPXInputStream *input, const int dataSize);
 306         void parse(WP3Listener *listener) const;
 307
 308   };
 309 --- 32,38 ----
 310   class WP3SubDocument : public WPXSubDocument
 311   {
 312   public:
 313 !       WP3SubDocument(WPXInputStream *input, const unsigned dataSize);
 314         void parse(WP3Listener *listener) const;
 315
 316   };
 317 *** misc/libwpd-0.8.8/src/lib/WP3TablesGroup.cpp        Wed Jan  3 13:07:55 2007
 318 --- misc/build/libwpd-0.8.8/src/lib/WP3TablesGroup.cpp  Thu Feb 21 11:37:54 2008
 319 ***************
 320 *** 50,59 ****
 321   {
 322         // this group can contain different kinds of data, thus we need to read
 323         // the contents accordingly
 324 !       uint8_t i;
 325         switch (getSubGroup())
 326         {
 327         case WP3_TABLES_GROUP_TABLE_FUNCTION:
 328                 input->seek(71, WPX_SEEK_CUR);
 329                 m_tableMode = readU8(input);
 330                 m_offsetFromLeftEdge = readU32(input, true);
 331 --- 50,61 ----
 332   {
 333         // this group can contain different kinds of data, thus we need to read
 334         // the contents accordingly
 335 !       uint8_t i=0;
 336 !       long startPosition = 0;
 337         switch (getSubGroup())
 338         {
 339         case WP3_TABLES_GROUP_TABLE_FUNCTION:
 340 +               startPosition = input->tell();
 341                 input->seek(71, WPX_SEEK_CUR);
 342                 m_tableMode = readU8(input);
 343                 m_offsetFromLeftEdge = readU32(input, true);
 344 ***************
 345 *** 63,70 ****
 346 --- 65,76 ----
 347                 m_rightGutterSpacing = readU32(input, true);
 348                 input->seek(3, WPX_SEEK_CUR);
 349                 m_numColumns = readU8(input);
 350 +               if ((m_numColumns > 32) || ((input->tell() - startPosition + m_numColumns*10) > (getSize() - 4)))
 351 +                       throw FileException();
 352                 for (i=0; i<m_numColumns; i++)
 353                 {
 354 +                       if (input->atEOS())
 355 +                               throw FileException();
 356                         m_columnMode[i] = readU8(input);
 357                         m_numberFormat[i] = readU8(input);
 358                         m_columnWidth[i] = readU32(input, true);
 359 ***************
 360 *** 120,126 ****
 361         {
 362         case WP3_TABLES_GROUP_TABLE_FUNCTION:
 363                 listener->defineTable(m_tableMode, fixedPointToWPUs(m_offsetFromLeftEdge));
 364 !               for (i=0; i<m_numColumns; i++)
 365                         listener->addTableColumnDefinition(fixedPointToWPUs(m_columnWidth[i]), fixedPointToWPUs(m_leftGutterSpacing),
 366                                                                 fixedPointToWPUs(m_rightGutterSpacing), 0, LEFT);
 367                 listener->startTable();
 368 --- 126,132 ----
 369         {
 370         case WP3_TABLES_GROUP_TABLE_FUNCTION:
 371                 listener->defineTable(m_tableMode, fixedPointToWPUs(m_offsetFromLeftEdge));
 372 !               for (i=0; i<m_numColumns && i <= 32; i++)
 373                         listener->addTableColumnDefinition(fixedPointToWPUs(m_columnWidth[i]), fixedPointToWPUs(m_leftGutterSpacing),
 374                                                                 fixedPointToWPUs(m_rightGutterSpacing), 0, LEFT);
 375                 listener->startTable();
 376 *** misc/libwpd-0.8.8/src/lib/WP3VariableLengthGroup.cpp        Wed Jan  3 13:07:55 2007
 377 --- misc/build/libwpd-0.8.8/src/lib/WP3VariableLengthGroup.cpp  Thu Feb 21 11:37:54 2008
 378 ***************
 379 *** 36,41 ****
 380 --- 36,42 ----
 381   #include "WP3FootnoteEndnoteGroup.h"
 382   #include "WP3TablesGroup.h"
 383   #include "libwpd_internal.h"
 384 + #include <limits>
 385
 386   WP3VariableLengthGroup::WP3VariableLengthGroup()
 387   {
 388 ***************
 389 *** 72,82 ****
 390 --- 73,90 ----
 391   bool WP3VariableLengthGroup::isGroupConsistent(WPXInputStream *input, const uint8_t group)
 392   {
 393         uint32_t startPosition = input->tell();
 394 +       if (startPosition > ((std::numeric_limits<unsigned long>::max)() / 2))
 395 +               return false;
 396
 397         try
 398         {
 399                 uint8_t subGroup = readU8(input);
 400                 uint16_t size = readU16(input, true);
 401 +               if (startPosition + size < startPosition)
 402 +               {
 403 +                       input->seek(startPosition, WPX_SEEK_SET);
 404 +                       return false;
 405 +               }
 406
 407                 if (input->seek((startPosition + size - 1 - input->tell()), WPX_SEEK_CUR) || input->atEOS())
 408                 {
 409 *** misc/libwpd-0.8.8/src/lib/WP42SubDocument.cpp       Wed Jan  3 13:07:55 2007
 410 --- misc/build/libwpd-0.8.8/src/lib/WP42SubDocument.cpp Thu Feb 21 11:37:54 2008
 411 ***************
 412 *** 26,37 ****
 413   #include "WP42Parser.h"
 414   #include "libwpd_internal.h"
 415
 416 ! WP42SubDocument::WP42SubDocument(uint8_t * streamData, const int dataSize) :
 417         WPXSubDocument(streamData, dataSize)
 418   {
 419   }
 420
 421 ! WP42SubDocument::WP42SubDocument(WPXInputStream *input, const int dataSize) :
 422         WPXSubDocument(input, dataSize)
 423   {
 424   }
 425 --- 26,37 ----
 426   #include "WP42Parser.h"
 427   #include "libwpd_internal.h"
 428
 429 ! WP42SubDocument::WP42SubDocument(uint8_t * streamData, const unsigned dataSize) :
 430         WPXSubDocument(streamData, dataSize)
 431   {
 432   }
 433
 434 ! WP42SubDocument::WP42SubDocument(WPXInputStream *input, const unsigned dataSize) :
 435         WPXSubDocument(input, dataSize)
 436   {
 437   }
 438 *** misc/libwpd-0.8.8/src/lib/WP42SubDocument.h Wed Jan  3 13:07:56 2007
 439 --- misc/build/libwpd-0.8.8/src/lib/WP42SubDocument.h   Thu Feb 21 11:37:54 2008
 440 ***************
 441 *** 32,39 ****
 442   class WP42SubDocument : public WPXSubDocument
 443   {
 444   public:
 445 !       WP42SubDocument(uint8_t * streamData, const int dataSize);
 446 !       WP42SubDocument(WPXInputStream *input, const int dataSize);
 447         void parse(WP42Listener *listener) const;
 448
 449   };
 450 --- 32,39 ----
 451   class WP42SubDocument : public WPXSubDocument
 452   {
 453   public:
 454 !       WP42SubDocument(uint8_t * streamData, const unsigned dataSize);
 455 !       WP42SubDocument(WPXInputStream *input, const unsigned dataSize);
 456         void parse(WP42Listener *listener) const;
 457
 458   };
 459 *** misc/libwpd-0.8.8/src/lib/WP5DefinitionGroup.cpp    Wed Jan  3 13:07:55 2007
 460 --- misc/build/libwpd-0.8.8/src/lib/WP5DefinitionGroup.cpp      Thu Feb 21 11:37:54 2008
 461 ***************
 462 *** 26,32 ****
 463   #include "WP5Listener.h"
 464   #include "libwpd_internal.h"
 465
 466 ! WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input) :
 467         WP5VariableLengthGroup_SubGroup(),
 468         m_position(0),
 469         m_numColumns(0),
 470 --- 26,32 ----
 471   #include "WP5Listener.h"
 472   #include "libwpd_internal.h"
 473
 474 ! WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize) :
 475         WP5VariableLengthGroup_SubGroup(),
 476         m_position(0),
 477         m_numColumns(0),
 478 ***************
 479 *** 34,39 ****
 480 --- 34,40 ----
 481         m_leftGutter(0),
 482         m_rightGutter(0)
 483   {
 484 +       long startPosition = input->tell();
 485         // Skip useless old values to read the old column number
 486         input->seek(2, WPX_SEEK_CUR);
 487         m_numColumns = readU16(input);
 488 ***************
 489 *** 50,61 ****
 490 --- 51,76 ----
 491         input->seek(10, WPX_SEEK_CUR);
 492         m_leftOffset = readU16(input);
 493         int i;
 494 +       if ((m_numColumns > 32) || ((input->tell() - startPosition + m_numColumns*5) > (subGroupSize - 4)))
 495 +               throw FileException();
 496         for (i=0; i < m_numColumns; i++)
 497 +       {
 498 +               if (input->atEOS())
 499 +                       throw FileException();
 500                 m_columnWidth[i] = readU16(input);
 501 +       }
 502         for (i=0; i < m_numColumns; i++)
 503 +       {
 504 +               if (input->atEOS())
 505 +                       throw FileException();
 506                 m_attributeBits[i] = readU16(input);
 507 +       }
 508         for (i=0; i < m_numColumns; i++)
 509 +       {
 510 +               if (input->atEOS())
 511 +                       throw FileException();
 512                 m_columnAlignment[i] = readU8(input);
 513 +       }
 514   }
 515
 516   void WP5DefinitionGroup_DefineTablesSubGroup::parse(WP5Listener *listener)
 517 ***************
 518 *** 88,94 ****
 519         switch(getSubGroup())
 520         {
 521                 case WP5_TOP_DEFINITION_GROUP_DEFINE_TABLES:
 522 !                       m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input);
 523                         break;
 524                 default:
 525                         break;
 526 --- 103,109 ----
 527         switch(getSubGroup())
 528         {
 529                 case WP5_TOP_DEFINITION_GROUP_DEFINE_TABLES:
 530 !                       m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input, getSize());
 531                         break;
 532                 default:
 533                         break;
 534 *** misc/libwpd-0.8.8/src/lib/WP5DefinitionGroup.h      Wed Jan  3 13:07:56 2007
 535 --- misc/build/libwpd-0.8.8/src/lib/WP5DefinitionGroup.h        Thu Feb 21 11:37:54 2008
 536 ***************
 537 *** 31,37 ****
 538   class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup
 539   {
 540   public:
 541 !       WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input);
 542         void parse(WP5Listener *listener);
 543
 544   private:
 545 --- 31,37 ----
 546   class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup
 547   {
 548   public:
 549 !       WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize);
 550         void parse(WP5Listener *listener);
 551
 552   private:
 553 ***************
 554 *** 58,64 ****
 555
 556   private:
 557         WP5VariableLengthGroup_SubGroup * m_subGroupData;
 558 -
 559   };
 560
 561   #endif /* WP5DEFINITIONGROUP_H */
 562 --- 58,63 ----
 563 *** misc/libwpd-0.8.8/src/lib/WP5SubDocument.cpp        Wed Jan  3 13:07:55 2007
 564 --- misc/build/libwpd-0.8.8/src/lib/WP5SubDocument.cpp  Thu Feb 21 11:37:54 2008
 565 ***************
 566 *** 26,32 ****
 567   #include "WP5Parser.h"
 568   #include "libwpd_internal.h"
 569
 570 ! WP5SubDocument::WP5SubDocument(WPXInputStream *input, const int dataSize) :
 571         WPXSubDocument(input, dataSize)
 572   {
 573   }
 574 --- 26,32 ----
 575   #include "WP5Parser.h"
 576   #include "libwpd_internal.h"
 577
 578 ! WP5SubDocument::WP5SubDocument(WPXInputStream *input, const unsigned dataSize) :
 579         WPXSubDocument(input, dataSize)
 580   {
 581   }
 582 *** misc/libwpd-0.8.8/src/lib/WP5SubDocument.h  Wed Jan  3 13:07:56 2007
 583 --- misc/build/libwpd-0.8.8/src/lib/WP5SubDocument.h    Thu Feb 21 11:37:54 2008
 584 ***************
 585 *** 32,38 ****
 586   class WP5SubDocument : public WPXSubDocument
 587   {
 588   public:
 589 !       WP5SubDocument(WPXInputStream *input, const int dataSize);
 590         void parse(WP5Listener *listener) const;
 591
 592   };
 593 --- 32,38 ----
 594   class WP5SubDocument : public WPXSubDocument
 595   {
 596   public:
 597 !       WP5SubDocument(WPXInputStream *input, const unsigned dataSize);
 598         void parse(WP5Listener *listener) const;
 599
 600   };
 601 *** misc/libwpd-0.8.8/src/lib/WP6ExtendedDocumentSummaryPacket.cpp      Fri Jan  5 10:30:07 2007
 602 --- misc/build/libwpd-0.8.8/src/lib/WP6ExtendedDocumentSummaryPacket.cpp        Thu Feb 21 11:37:54 2008
 603 ***************
 604 *** 24,29 ****
 605 --- 24,30 ----
 606    * Corel Corporation or Corel Corporation Limited."
 607    */
 608   #include <string.h>
 609 + #include <limits>
 610
 611   #include "WP6ExtendedDocumentSummaryPacket.h"
 612   #include "libwpd_internal.h"
 613 ***************
 614 *** 47,52 ****
 615 --- 48,55 ----
 616   {
 617         if (m_dataSize <= 0)
 618                 return;
 619 +       if (m_dataSize > ((std::numeric_limits<uint32_t>::max)() / 2))
 620 +               m_dataSize = ((std::numeric_limits<uint32_t>::max)() / 2);
 621         uint8_t *streamData = new uint8_t[m_dataSize];
 622         for(unsigned i=0; i<(unsigned)m_dataSize; i++)
 623                 streamData[i] = readU8(input);
 624 *** misc/libwpd-0.8.8/src/lib/WP6FontDescriptorPacket.cpp       Thu Jan  4 11:52:35 2007
 625 --- misc/build/libwpd-0.8.8/src/lib/WP6FontDescriptorPacket.cpp Thu Feb 21 11:37:54 2008
 626 ***************
 627 *** 23,29 ****
 628    * Corel Corporation or Corel Corporation Limited."
 629    */
 630   #include <string.h>
 631 !
 632   #include "WP6FontDescriptorPacket.h"
 633   #include "libwpd_internal.h"
 634
 635 --- 23,29 ----
 636    * Corel Corporation or Corel Corporation Limited."
 637    */
 638   #include <string.h>
 639 ! #include <limits>
 640   #include "WP6FontDescriptorPacket.h"
 641   #include "libwpd_internal.h"
 642
 643 ***************
 644 *** 69,77 ****
 645
 646      m_fontNameLength = readU16(input);
 647
 648 !    // TODO: re-do sanity checking
 649 !    //if(m_fontNameLength < WP_FONT_NAME_MAX_LENGTH)
 650 !    //{
 651      if (m_fontNameLength == 0)
 652            {
 653                    m_fontName = new char[1];
 654 --- 69,77 ----
 655
 656      m_fontNameLength = readU16(input);
 657
 658 !
 659 !    if (m_fontNameLength > ((std::numeric_limits<uint16_t>::max)() / 2))
 660 !        m_fontNameLength = ((std::numeric_limits<uint16_t>::max)() / 2);
 661      if (m_fontNameLength == 0)
 662            {
 663                    m_fontName = new char[1];
 664 *** misc/libwpd-0.8.8/src/lib/WP6GeneralTextPacket.cpp  Wed Jan  3 13:07:55 2007
 665 --- misc/build/libwpd-0.8.8/src/lib/WP6GeneralTextPacket.cpp    Thu Feb 21 11:37:54 2008
 666 ***************
 667 *** 43,48 ****
 668 --- 43,49 ----
 669
 670   void WP6GeneralTextPacket::_readContents(WPXInputStream *input)
 671   {
 672 +       long startPosition = input->tell();
 673         uint16_t numTextBlocks = readU16(input);
 674         input->seek(4, WPX_SEEK_CUR);
 675
 676 ***************
 677 *** 53,65 ****
 678         }
 679
 680         uint32_t *blockSizes = new uint32_t[numTextBlocks];
 681 !       int totalSize = 0;
 682 !       unsigned int i;
 683
 684         for(i=0; i<numTextBlocks; i++)
 685         {
 686                 blockSizes[i] = readU32(input);
 687 !               totalSize += blockSizes[i];
 688         }
 689
 690         if (totalSize <= 0)
 691 --- 54,71 ----
 692         }
 693
 694         uint32_t *blockSizes = new uint32_t[numTextBlocks];
 695 !       unsigned int totalSize = 0;
 696 !       unsigned int i = 0;
 697
 698         for(i=0; i<numTextBlocks; i++)
 699         {
 700 +               if ((input->tell() - startPosition + 4) > getDataSize() || input->atEOS())
 701 +                       throw FileException();
 702                 blockSizes[i] = readU32(input);
 703 !               unsigned int newTotalSize = totalSize + blockSizes[i];
 704 !               if (newTotalSize < totalSize)
 705 !                       throw FileException();
 706 !               totalSize = newTotalSize;
 707         }
 708
 709         if (totalSize <= 0)
 710 ***************
 711 *** 73,78 ****
 712 --- 79,86 ----
 713         int streamPos = 0;
 714         for(i=0; i<numTextBlocks; i++)
 715         {
 716 +               if ((input->tell() - startPosition + blockSizes[i]) > getDataSize() || input->atEOS())
 717 +                       throw FileException();
 718                 for (unsigned int j=0; j<blockSizes[i]; j++)
 719                 {
 720                         streamData[streamPos] = readU8(input);
 721 *** misc/libwpd-0.8.8/src/lib/WP6PrefixDataPacket.cpp   Wed Jan  3 13:07:55 2007
 722 --- misc/build/libwpd-0.8.8/src/lib/WP6PrefixDataPacket.cpp     Thu Feb 21 11:37:54 2008
 723 ***************
 724 *** 35,41 ****
 725   #include "libwpd.h"
 726   #include "libwpd_internal.h"
 727
 728 ! WP6PrefixDataPacket::WP6PrefixDataPacket(WPXInputStream * /* input */)
 729   {
 730   }
 731
 732 --- 35,42 ----
 733   #include "libwpd.h"
 734   #include "libwpd_internal.h"
 735
 736 ! WP6PrefixDataPacket::WP6PrefixDataPacket(WPXInputStream * /* input */) :
 737 !       m_dataSize(0)
 738   {
 739   }
 740
 741 ***************
 742 *** 74,80 ****
 743
 744   void WP6PrefixDataPacket::_read(WPXInputStream *input, uint32_t dataOffset, uint32_t dataSize)
 745   {
 746 !       if (!dataSize)
 747                 return;
 748
 749         input->seek(dataOffset, WPX_SEEK_SET);
 750 --- 75,83 ----
 751
 752   void WP6PrefixDataPacket::_read(WPXInputStream *input, uint32_t dataOffset, uint32_t dataSize)
 753   {
 754 !       m_dataSize = dataSize;
 755 !
 756 !       if (!m_dataSize)
 757                 return;
 758
 759         input->seek(dataOffset, WPX_SEEK_SET);
 760 *** misc/libwpd-0.8.8/src/lib/WP6PrefixDataPacket.h     Wed Jan  3 13:07:56 2007
 761 --- misc/build/libwpd-0.8.8/src/lib/WP6PrefixDataPacket.h       Thu Feb 21 11:37:54 2008
 762 ***************
 763 *** 39,50 ****
 764 --- 39,54 ----
 765         virtual ~WP6PrefixDataPacket() {}
 766         virtual void parse(WP6Listener * /* listener */) const {}
 767         virtual WP6SubDocument * getSubDocument() const { return 0; }
 768 +       const uint32_t getDataSize() const { return m_dataSize; }
 769
 770         static WP6PrefixDataPacket * constructPrefixDataPacket(WPXInputStream * input, WP6PrefixIndice *prefixIndice);
 771
 772   protected:
 773         virtual void _readContents(WPXInputStream *input) = 0;
 774         void _read(WPXInputStream *input, uint32_t dataOffset, uint32_t dataSize);
 775 +
 776 + private:
 777 +       uint32_t m_dataSize;
 778   };
 779
 780   #endif /* WP6PREFIXDATAPACKET_H */
 781 *** misc/libwpd-0.8.8/src/lib/WP6SubDocument.cpp        Wed Jan  3 13:07:55 2007
 782 --- misc/build/libwpd-0.8.8/src/lib/WP6SubDocument.cpp  Thu Feb 21 11:37:54 2008
 783 ***************
 784 *** 26,32 ****
 785   #include "WP6Parser.h"
 786   #include "libwpd_internal.h"
 787
 788 ! WP6SubDocument::WP6SubDocument(uint8_t * streamData, const int dataSize) :
 789         WPXSubDocument(streamData, dataSize)
 790   {
 791   }
 792 --- 26,32 ----
 793   #include "WP6Parser.h"
 794   #include "libwpd_internal.h"
 795
 796 ! WP6SubDocument::WP6SubDocument(uint8_t * streamData, const unsigned dataSize) :
 797         WPXSubDocument(streamData, dataSize)
 798   {
 799   }
 800 *** misc/libwpd-0.8.8/src/lib/WP6SubDocument.h  Wed Jan  3 13:07:56 2007
 801 --- misc/build/libwpd-0.8.8/src/lib/WP6SubDocument.h    Thu Feb 21 11:37:54 2008
 802 ***************
 803 *** 32,38 ****
 804   class WP6SubDocument : public WPXSubDocument
 805   {
 806   public:
 807 !       WP6SubDocument(uint8_t * streamData, const int dataSize);
 808         void parse(WP6Listener *listener) const;
 809   };
 810   #endif /* WP6SUBDOCUMENT_H */
 811 --- 32,38 ----
 812   class WP6SubDocument : public WPXSubDocument
 813   {
 814   public:
 815 !       WP6SubDocument(uint8_t * streamData, const unsigned dataSize);
 816         void parse(WP6Listener *listener) const;
 817   };
 818   #endif /* WP6SUBDOCUMENT_H */
 819 *** misc/libwpd-0.8.8/src/lib/WPXHeader.cpp     Wed Jan  3 16:40:14 2007
 820 --- misc/build/libwpd-0.8.8/src/lib/WPXHeader.cpp       Thu Feb 21 11:40:46 2008
 821 ***************
 822 *** 31,36 ****
 823 --- 31,37 ----
 824   #include "WP61Header.h"
 825   #include "WPXFileStructure.h"
 826   #include "libwpd_internal.h"
 827 + #include <string.h>
 828
 829   WPXHeader::WPXHeader(WPXInputStream * /* input */, uint32_t documentOffset, uint8_t productType,
 830                         uint8_t fileType, uint8_t majorVersion, uint8_t minorVersion, uint16_t documentEncryption) :
 831 *** misc/libwpd-0.8.8/src/lib/WPXSubDocument.cpp        Wed Jan  3 13:07:56 2007
 832 --- misc/build/libwpd-0.8.8/src/lib/WPXSubDocument.cpp  Thu Feb 21 11:37:54 2008
 833 ***************
 834 *** 32,49 ****
 835   {
 836   }
 837
 838 ! WPXSubDocument::WPXSubDocument(WPXInputStream *input, const int dataSize) :
 839         m_stream(0)
 840   {
 841         uint8_t *streamData = new uint8_t[dataSize];
 842         for (int i=0; i<dataSize; i++)
 843         {
 844                 streamData[i] = readU8(input);
 845         }
 846         m_stream = new WPXMemoryInputStream(streamData, dataSize);
 847   }
 848
 849 ! WPXSubDocument::WPXSubDocument(uint8_t * streamData, const int dataSize) :
 850         m_stream(0)
 851   {
 852         m_stream = new WPXMemoryInputStream(streamData, dataSize);
 853 --- 32,51 ----
 854   {
 855   }
 856
 857 ! WPXSubDocument::WPXSubDocument(WPXInputStream *input, const unsigned dataSize) :
 858         m_stream(0)
 859   {
 860         uint8_t *streamData = new uint8_t[dataSize];
 861         for (int i=0; i<dataSize; i++)
 862         {
 863 +               if (input->atEOS())
 864 +                       throw FileException();
 865                 streamData[i] = readU8(input);
 866         }
 867         m_stream = new WPXMemoryInputStream(streamData, dataSize);
 868   }
 869
 870 ! WPXSubDocument::WPXSubDocument(uint8_t * streamData, const unsigned dataSize) :
 871         m_stream(0)
 872   {
 873         m_stream = new WPXMemoryInputStream(streamData, dataSize);
 874 *** misc/libwpd-0.8.8/src/lib/WPXSubDocument.h  Wed Jan  3 13:07:56 2007
 875 --- misc/build/libwpd-0.8.8/src/lib/WPXSubDocument.h    Thu Feb 21 11:37:54 2008
 876 ***************
 877 *** 33,40 ****
 878   {
 879   public:
 880         WPXSubDocument();
 881 !       WPXSubDocument(WPXInputStream *input, const int dataSize);
 882 !       WPXSubDocument(uint8_t * streamData, const int dataSize);
 883         virtual ~WPXSubDocument();
 884         WPXMemoryInputStream *getStream() const { return m_stream;}
 885
 886 --- 33,40 ----
 887   {
 888   public:
 889         WPXSubDocument();
 890 !       WPXSubDocument(WPXInputStream *input, const unsigned dataSize);
 891 !       WPXSubDocument(uint8_t * streamData, const unsigned dataSize);
 892         virtual ~WPXSubDocument();
 893         WPXMemoryInputStream *getStream() const { return m_stream;}
 894
 895 *** misc/libwpd-0.8.8/src/lib/makefile.mk       Tue Nov 14 14:45:50 2006
 896 --- misc/build/libwpd-0.8.8/src/lib/makefile.mk Thu Feb 21 11:37:54 2008
 897 ***************
 898 *** 7,15 ****
 899   ENABLE_EXCEPTIONS=TRUE
 900   LIBTARGET=NO
 901
 902 - .INCLUDE :  svpre.mk
 903   .INCLUDE :  settings.mk
 904 - .INCLUDE :  sv.mk
 905
 906   .IF "$(GUI)"=="WNT"
 907   CFLAGS+=-GR
 908 --- 7,13 ----