← Back to branch summary

~ubuntu-branches/ubuntu/breezy/koffice/breezy-security

« back to all changes in this revision

Viewing changes to kword/KWordTableFrameSetIface.cc

  • Committer: Bazaar Package Importer
  • Author(s): Jonathan Riddell
  • Date: 2005-10-11 14:49:50 UTC
  • mfrom: (1.1.2 upstream)
  • Revision ID: james.westby@ubuntu.com-20051011144950-lwpngbifzp8nk0ds
Tags: 1:1.4.1-0ubuntu7
* SECURITY UPDATE: fix heap based buffer overflow in the RTF importer of KWord
* Opening specially crafted RTF files in KWord can cause
  execution of abitrary code.
* Add kubuntu_01_rtfimport_heap_overflow.diff
* References:
  CAN-2005-2971
  CESA-2005-005
  http://www.koffice.org/security/advisory-20051011-1.txt

Show diffs side-by-side

added added

removed removed

Lines of Context:
kword/KWordTableFrameSetIface.cc
67
67
    for(; i && p <= pos; ++i,++p)
68
68
    if( ! i.current() )
69
69
        return DCOPRef();
70
 
    
 
70
 
71
71
    return DCOPRef( kapp->dcopClient()->appId(),
72
72
            i->dcopObject()->objId() );
73
73
}
86
86
        return DCOPRef();
87
87
 
88
88
    KWDocument *doc=m_table->kWordDocument();
89
 
    QPtrList <KWView> lst=doc->getAllViews();
 
89
    KWView* view = doc->getAllViews().first();
 
90
    KWCanvas* canvas = view->getGUI()->canvasWidget();
90
91
    KWTextFrameSet *m_frametext=m_table->getCell(row,col);
91
92
    if( !m_frametext || m_frametext->isDeleted())
92
93
        return DCOPRef();
93
 
    lst.at(0)->getGUI()->canvasWidget()->checkCurrentEdit(m_frametext, true);
 
94
    canvas->checkCurrentEdit(m_frametext, true);
94
95
    return DCOPRef( kapp->dcopClient()->appId(),
95
 
                    (static_cast<KWTextFrameSetEdit *>( lst.at(0)->getGUI()->canvasWidget()->currentFrameSetEdit()))->dcopObject()->objId() );
 
96
                    (static_cast<KWTextFrameSetEdit *>( canvas->currentFrameSetEdit()))->dcopObject()->objId() );
96
97
}