[PATCH] ofz: ignore an advance array shorter than the string

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I6ceec1ecbae58a714d2f45eb786e01b428e6d942
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6114
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 6ab602ca281f507f7e637183a49dd514ffb1376b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207656
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 4406da79b0715411528c17f93ae7ebcb29b9a0d2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207677
(cherry picked from commit acf64b67cceecf3d1acd26033668b6673208bcf2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207715
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Gbp-Pq: Name CVE-2026-63272.diff

diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx
index 5c16df6e42b2a86fc1bdb3ccdfbaf1a9569ff2a7..18bdd26c616c05a0eb3f752cbb1f847ee58b01c6 100644 (file)
--- a/emfio/source/reader/wmfreader.cxx
+++ b/emfio/source/reader/wmfreader.cxx
@@ -1274,7 +1274,7 @@ namespace emfio
                                                     GetFont().GetFamilyName()))
                                             {
                                                 Point aPt;
-                                                sal_uInt32 nStringLen, nDXCount;
+                                                sal_uInt32 nStringLen(0), nDXCount(0);
                                                 KernArray aDXAry;
                                                 SvMemoryStream aMemoryStream(nEscLen);
                                                 aMemoryStream.WriteBytes(pData.get(), nEscLen);
@@ -1293,6 +1293,8 @@ namespace emfio
                                                     OUString aString = read_uInt16s_ToOUString(
                                                         aMemoryStream, nStringLen);
                                                     aMemoryStream.ReadUInt32(nDXCount);
+                                                    if (nDXCount < o3tl::make_unsigned(aString.getLength()))
+                                                        nDXCount = 0;
                                                     if ((static_cast<sal_uInt64>(nDXCount)
                                                         * sizeof(sal_Int32))
                                                         >= (nEscLen - aMemoryStream.Tell()))
@@ -1301,7 +1303,7 @@ namespace emfio
                                                         aDXAry.resize(nDXCount);
                                                     for (sal_uInt32 i = 0; i < nDXCount; i++)
                                                     {
-                                                        sal_Int32 val;
+                                                        sal_Int32 val(0);
                                                         aMemoryStream.ReadInt32(val);
                                                         aDXAry[i] = val;
                                                     }