52e1a6a3e4
EmbeddedObjectRef::GetGraphicStream() creates a writable SvMemoryStream, read the graphics data into it and then returns the stream, which will be afterwards used to decode the graphics. But if the data is broken, incorrect seeking may cause a seek way past the buffer, and since the stream is writable, it would be done and cause problems such as running out of memory. The VersionCompatRead class is one such place that reads size from the stream and then seeks based on the read data. Add SvMemoryStream::MakeReadOnly() that will change the stream to be read-only after the initial read of the data into it. Change-Id: I1d44aabaf73071a691adafa489e65e4f5e3f021d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137002 Tested-by: Jenkins Reviewed-by: Luboš Luňák <l.lunak@collabora.com> |
||
|---|---|---|
| .. | ||
| b3dtrans.hxx | ||
| bigint.hxx | ||
| color.hxx | ||
| config.hxx | ||
| contnr.hxx | ||
| cpuid.hxx | ||
| date.hxx | ||
| datetime.hxx | ||
| datetimeutils.hxx | ||
| debug.hxx | ||
| degree.hxx | ||
| diagnose_ex.h | ||
| extendapplicationenvironment.hxx | ||
| fileutil.hxx | ||
| fix16.hxx | ||
| fldunit.hxx | ||
| fontenum.hxx | ||
| fract.hxx | ||
| gen.hxx | ||
| GenericTypeSerializer.hxx | ||
| globname.hxx | ||
| Guid.hxx | ||
| helpers.hxx | ||
| inetmime.hxx | ||
| inetmsg.hxx | ||
| inetstrm.hxx | ||
| json_writer.hxx | ||
| line.hxx | ||
| lineend.hxx | ||
| link.hxx | ||
| long.hxx | ||
| mapunit.hxx | ||
| multisel.hxx | ||
| pathutils.hxx | ||
| poly.hxx | ||
| ref.hxx | ||
| resary.hxx | ||
| simd.hxx | ||
| simdsupport.hxx | ||
| solar.h | ||
| stream.hxx | ||
| svborder.hxx | ||
| svlibrary.h | ||
| tenccvt.hxx | ||
| time.hxx | ||
| toolsdllapi.h | ||
| UnitConversion.hxx | ||
| urlobj.hxx | ||
| vcompat.hxx | ||
| weakbase.h | ||
| weakbase.hxx | ||
| wintypes.hxx | ||
| wldcrd.hxx | ||
| XmlWalker.hxx | ||
| XmlWriter.hxx | ||
| zcodec.hxx | ||