CVE-2026-6039

CVE-2026-6039: DXF heap-buffer-overflow in DrawLWPolyLineEntity

It looks like our oss-fuzz efforts didn't find this because we capped
the dxffuzzer.options size at 64KB which is too small to capture this
issue.

From cf825c7608ded2cb1b7c846bde15d0ebcf6a5c44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Thu, 9 Apr 2026 17:23:39 +0100
Subject: [PATCH] stay within max Polygon points

Change-Id: I02e34bb413e6332d8c5683504a63a591a33d7730
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203575
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203626
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name CVE-2026-6039.diff

diff --git a/vcl/source/filter/idxf/dxf2mtf.cxx b/vcl/source/filter/idxf/dxf2mtf.cxx
index 53bdcfd98bc14c353df188e4f89eb244c8aebbcd..86b60e3b6de471b624cb481dc401e1ec4eee32ae 100644 (file)
--- a/vcl/source/filter/idxf/dxf2mtf.cxx
+++ b/vcl/source/filter/idxf/dxf2mtf.cxx
@@ -554,13 +554,17 @@ void DXF2GDIMetaFile::DrawPolyLineEntity(const DXFPolyLineEntity & rE, const DXF
 void DXF2GDIMetaFile::DrawLWPolyLineEntity(const DXFLWPolyLineEntity & rE, const DXFTransform & rTransform )
 {
     sal_Int32 nPolySize = rE.aP.size();
-    if (!nPolySize)
+    if (nPolySize <= 0 || nPolySize > SAL_MAX_UINT16)
+    {
+        SAL_WARN("vcl.filter", "DXF2GDIMetaFile::DrawLWPolyLineEntity: invalid num of points: " << nPolySize);
         return;
+    }
 
-    tools::Polygon aPoly( static_cast<sal_uInt16>(nPolySize));
-    for (sal_Int32 i = 0; i < nPolySize; ++i)
+    sal_uInt16 nSize = static_cast<sal_uInt16>(nPolySize);
+    tools::Polygon aPoly(nSize);
+    for (sal_uInt16 i = 0; i < nSize; ++i)
     {
-        rTransform.Transform( rE.aP[ static_cast<sal_uInt16>(i) ], aPoly[ static_cast<sal_uInt16>(i) ] );
+        rTransform.Transform( rE.aP[i], aPoly[i] );
     }
     if ( SetLineAttribute( rE ) )
     {

diff --git a/vcl/workben/dxffuzzer.options b/vcl/workben/dxffuzzer.options
index 678d526b1ea9bd68f971f99476098759f149e2db..965216112046742b89cab841201c952a0ee04182 100644 (file)
--- a/vcl/workben/dxffuzzer.options
+++ b/vcl/workben/dxffuzzer.options
@@ -1,2 +1,2 @@
 [libfuzzer]
-max_len = 65536
+max_len = 524288