Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
View | Details | Raw Unified | Return to bug 169675
Collapse All | Expand All

(-)WP5DefinitionGroup.cpp (-2 / +17 lines)
Lines 26-32 Link Here
26
#include "WP5Listener.h"
26
#include "WP5Listener.h"
27
#include "libwpd_internal.h"
27
#include "libwpd_internal.h"
28
28
29
WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input) :
29
WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize) :
30
	WP5VariableLengthGroup_SubGroup(),
30
	WP5VariableLengthGroup_SubGroup(),
31
	m_position(0),
31
	m_position(0),
32
	m_numColumns(0),
32
	m_numColumns(0),
Lines 34-39 Link Here
34
	m_leftGutter(0),
34
	m_leftGutter(0),
35
	m_rightGutter(0)
35
	m_rightGutter(0)
36
{
36
{
37
	long startPosition = input->tell();
37
	// Skip useless old values to read the old column number
38
	// Skip useless old values to read the old column number
38
	input->seek(2, WPX_SEEK_CUR);
39
	input->seek(2, WPX_SEEK_CUR);
39
	m_numColumns = readU16(input);
40
	m_numColumns = readU16(input);
Lines 50-61 Link Here
50
	input->seek(10, WPX_SEEK_CUR);
51
	input->seek(10, WPX_SEEK_CUR);
51
	m_leftOffset = readU16(input);
52
	m_leftOffset = readU16(input);
52
	int i;
53
	int i;
54
	if ((m_numColumns > 32) || ((input->tell() - startPosition + m_numColumns*5) > (subGroupSize - 4)))
55
		throw FileException();
53
	for (i=0; i < m_numColumns; i++)
56
	for (i=0; i < m_numColumns; i++)
57
	{
58
		if (input->atEOS())
59
			throw FileException();
54
		m_columnWidth[i] = readU16(input);
60
		m_columnWidth[i] = readU16(input);
61
	}
55
	for (i=0; i < m_numColumns; i++)
62
	for (i=0; i < m_numColumns; i++)
63
	{
64
		if (input->atEOS())
65
			throw FileException();
56
		m_attributeBits[i] = readU16(input);
66
		m_attributeBits[i] = readU16(input);
67
	}
57
	for (i=0; i < m_numColumns; i++)
68
	for (i=0; i < m_numColumns; i++)
69
	{
70
		if (input->atEOS())
71
			throw FileException();
58
		m_columnAlignment[i] = readU8(input);
72
		m_columnAlignment[i] = readU8(input);
73
	}
59
}
74
}
60
75
61
void WP5DefinitionGroup_DefineTablesSubGroup::parse(WP5Listener *listener)
76
void WP5DefinitionGroup_DefineTablesSubGroup::parse(WP5Listener *listener)
Lines 88-94 Link Here
88
	switch(getSubGroup())
103
	switch(getSubGroup())
89
	{
104
	{
90
		case WP5_TOP_DEFINITION_GROUP_DEFINE_TABLES:
105
		case WP5_TOP_DEFINITION_GROUP_DEFINE_TABLES:
91
			m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input);
106
			m_subGroupData = new WP5DefinitionGroup_DefineTablesSubGroup(input, getSize());
92
			break;
107
			break;
93
		default:
108
		default:
94
			break;
109
			break;
(-)WP5DefinitionGroup.h (-2 / +1 lines)
Lines 31-37 Link Here
31
class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup
31
class WP5DefinitionGroup_DefineTablesSubGroup : public WP5VariableLengthGroup_SubGroup
32
{
32
{
33
public:
33
public:
34
	WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input);
34
	WP5DefinitionGroup_DefineTablesSubGroup(WPXInputStream *input, uint16_t subGroupSize);
35
	void parse(WP5Listener *listener);
35
	void parse(WP5Listener *listener);
36
36
37
private:
37
private:
Lines 58-64 Link Here
58
58
59
private:
59
private:
60
	WP5VariableLengthGroup_SubGroup * m_subGroupData;
60
	WP5VariableLengthGroup_SubGroup * m_subGroupData;
61
62
};
61
};
63
62
64
#endif /* WP5DEFINITIONGROUP_H */
63
#endif /* WP5DEFINITIONGROUP_H */

Return to bug 169675