← Back to branch summary

~ubuntu-branches/ubuntu/breezy/koffice/breezy-security

« back to all changes in this revision

Viewing changes to lib/kofficecore/koPictureWmf.cc

  • Committer: Bazaar Package Importer
  • Author(s): Jonathan Riddell
  • Date: 2005-10-11 14:49:50 UTC
  • mfrom: (1.1.2 upstream)
  • Revision ID: james.westby@ubuntu.com-20051011144950-lwpngbifzp8nk0ds
Tags: 1:1.4.1-0ubuntu7
* SECURITY UPDATE: fix heap based buffer overflow in the RTF importer of KWord
* Opening specially crafted RTF files in KWord can cause
  execution of abitrary code.
* Add kubuntu_01_rtfimport_heap_overflow.diff
* References:
  CAN-2005-2971
  CESA-2005-005
  http://www.koffice.org/security/advisory-20051011-1.txt

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/kofficecore/koPictureWmf.cc
83
83
    drawQPicture(m_clipart, painter, x, y, width, height, sx, sy, sw, sh);
84
84
}
85
85
 
86
 
bool KoPictureWmf::load(const QByteArray& array, const QString& /* extension */)
 
86
bool KoPictureWmf::loadData(const QByteArray& array, const QString& /* extension */)
87
87
{
88
88
    // Second, create the original clipart
89
89
    kdDebug(30003) << "Trying to load clipart... (Size:" << array.size() << ")" << endl;
90
90
    m_rawData=array;
91
 
    
 
91
 
92
92
    KoWmfPaint wmf;
93
93
    if (!wmf.load(array))
94
94
    {
98
98
    m_originalSize = wmf.boundingRect().size();
99
99
    // draw wmf file with relative coordinate
100
100
    wmf.play(m_clipart, true);
101
 
    
 
101
 
102
102
    return true;
103
103
}
104
104
 
105
 
bool KoPictureWmf::save(QIODevice* io)
 
105
bool KoPictureWmf::save(QIODevice* io) const
106
106
{
107
107
    // We save the raw data, as the SVG supposrt in QPicture is poor
108
108
    Q_ULONG size=io->writeBlock(m_rawData); // WARNING: writeBlock returns Q_LONG but size() Q_ULONG!
109
109
    return (size==m_rawData.size());
110
110
}
111
111
 
112
 
bool KoPictureWmf::saveAsKOffice1Dot1(QIODevice* io, const QString& /* extension */)
 
112
bool KoPictureWmf::saveAsKOffice1Dot1(QIODevice* io, const QString& /* extension */) const
113
113
{
114
114
    QPicture picture(3); //compatibility with QT 2.1 and later (KOffice 1.1.x was with QT 2.3.1 or QT 3.0.x)
115
115