← Back to branch summary

~ubuntu-branches/ubuntu/jaunty/libwpd/jaunty

« back to all changes in this revision

Viewing changes to src/lib/WP3VariableLengthGroup.cpp

  • Committer: Bazaar Package Importer
  • Author(s): Rene Engelhard
  • Date: 2007-03-16 10:17:21 UTC
  • mfrom: (1.1.8 upstream)
  • Revision ID: james.westby@ubuntu.com-20070316101721-e99xqbffo7rmm5vo
Tags: 0.8.9-1
http://bugs.debian.org/409312
* new upstream release
  - fixes CVE-2007-0002
* merge 0.8.7-5s Depends: fix (closes: #409312)

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/lib/WP3VariableLengthGroup.cpp
36
36
#include "WP3FootnoteEndnoteGroup.h"
37
37
#include "WP3TablesGroup.h"
38
38
#include "libwpd_internal.h"
 
39
#include <limits>
39
40
 
40
41
WP3VariableLengthGroup::WP3VariableLengthGroup()
41
42
{
72
73
bool WP3VariableLengthGroup::isGroupConsistent(WPXInputStream *input, const uint8_t group)
73
74
{
74
75
        uint32_t startPosition = input->tell();
 
76
        if (startPosition > ((std::numeric_limits<unsigned long>::max)() / 2))
 
77
                return false;
75
78
 
76
79
        try
77
80
        {
78
81
                uint8_t subGroup = readU8(input);
79
82
                uint16_t size = readU16(input, true);
 
83
                if (startPosition + size < startPosition)
 
84
                {
 
85
                        input->seek(startPosition, WPX_SEEK_SET);
 
86
                        return false;
 
87
                }
80
88
 
81
89
                if (input->seek((startPosition + size - 1 - input->tell()), WPX_SEEK_CUR) || input->atEOS())
82
90
                {