From 578a792fdaeddf43f8d4f9e1e1634220bb0732c8 Mon Sep 17 00:00:00 2001
From: "Elena.Subbotina" <Elena.Subbotina@onlyoffice.com>
Date: Sun, 24 Dec 2023 17:20:56 +0300
Subject: [PATCH] fix bug #65259

---
 MsBinaryFile/Common/Vba/Records.cpp   | 20 +++++++++++++++++++-
 MsBinaryFile/Common/Vba/Records.h     |  2 ++
 MsBinaryFile/Common/Vba/VbaReader.cpp | 11 ++++++++---
 MsBinaryFile/DocFile/MemoryStream.cpp |  2 ++
 OOXML/DocxFormat/Media/ActiveX.cpp    |  2 ++
 5 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/MsBinaryFile/Common/Vba/Records.cpp b/MsBinaryFile/Common/Vba/Records.cpp
index 02d7ba7207..775ed93cfb 100644
--- a/MsBinaryFile/Common/Vba/Records.cpp
+++ b/MsBinaryFile/Common/Vba/Records.cpp
@@ -148,6 +148,9 @@ namespace VBA
 	std::wstring readStringPadding(CVbaFileStreamPtr stream, _UINT32 & size)
 	{
 		if (!stream) return L"";
+		
+		if ( GETBITS(size, 0, 30) > 0xfff)
+			return L"";
 
 		std::wstring result = readString(stream->getDataCurrent(), size);
 
@@ -1238,6 +1241,11 @@ namespace VBA
 		
 		TypeOrCount = GETBITS(flag, 0, 6);
 		fCount = GETBIT(flag, 7);
+
+		if (fCount == 1)
+		{
+			*stream >> OptionalType; // 1 - OLE control
+		}
 	}
 //------------------------------------------------------------------------------------------
 	OleSiteConcreteControl::OleSiteConcreteControl(CVbaFileStreamPtr stream) { load(stream); }
@@ -1308,10 +1316,17 @@ namespace VBA
 		{
 			*stream >> RuntimeLicKeyLengthAndCompression;
 		}
+		pos1 = stream->GetDataPos();
 		if (propMask.fControlSource)
 		{
 			*stream >> ControlSourceLengthAndCompression;
 		}
+		//pos2 = stream->GetDataPos();
+		//count_padding = 4 - ((pos2 - pos1) % 4);
+
+		//if (count_padding > 0 && count_padding < 4)
+		//	stream->skipBytes(count_padding);
+
 		if (propMask.fRowSource)
 		{
 			*stream >> RowSourceLengthAndCompression;
@@ -1366,7 +1381,10 @@ namespace VBA
 			}
 		}		
 		_UINT32 CountOfSites = 0, CountOfBytes = 0;
-		*stream >> CountOfSites >> CountOfBytes;		
+		*stream >> CountOfSites >> CountOfBytes;	
+
+		if (CountOfSites > 0xffff)
+			return;
 		
 		_UINT32 pos1 = stream->GetDataPos();
 
diff --git a/MsBinaryFile/Common/Vba/Records.h b/MsBinaryFile/Common/Vba/Records.h
index 835e385b0d..9e1f94c65f 100644
--- a/MsBinaryFile/Common/Vba/Records.h
+++ b/MsBinaryFile/Common/Vba/Records.h
@@ -886,6 +886,8 @@ namespace VBA
 		unsigned char Depth = 0;
 		unsigned char TypeOrCount = 0;
 		bool fCount = false;
+
+		_CP_OPT(unsigned char) OptionalType;
 	};
 	typedef boost::shared_ptr<FormObjectDepthTypeCount> FormObjectDepthTypeCountPtr;
 //--------------------------------------------------------------------------------------------------------------
diff --git a/MsBinaryFile/Common/Vba/VbaReader.cpp b/MsBinaryFile/Common/Vba/VbaReader.cpp
index ed1c1195e5..dd00d752c8 100644
--- a/MsBinaryFile/Common/Vba/VbaReader.cpp
+++ b/MsBinaryFile/Common/Vba/VbaReader.cpp
@@ -325,13 +325,18 @@ std::wstring CVbaReader::convertObject(const std::wstring & name, unsigned int c
 					{
 						for (size_t i = 0; i < FormControlStream->SiteData->Sites.size(); ++i)
 						{
+							if (strmObject->getDataSize() < nextStreamPositionEmbedded)
+								break;
 							VBA::OleSiteConcreteControlPtr & site = FormControlStream->SiteData->Sites[i];
 							if (site->ObjectStreamSize && strmObject)
 							{
-								site->Object = VBA::ActiveXObjectPtr(OOX::ActiveXObject::Create(*site->ClsidCacheIndex));
+								site->Object = VBA::ActiveXObjectPtr(OOX::ActiveXObject::Create(site->ClsidCacheIndex ? *site->ClsidCacheIndex : 0));
 
-								site->Object->Parse(strmObject->getData() + nextStreamPositionEmbedded, *site->ObjectStreamSize);
-								nextStreamPositionEmbedded += *site->ObjectStreamSize;
+								if (site->ObjectStreamSize)
+								{
+									site->Object->Parse(strmObject->getData() + nextStreamPositionEmbedded, *site->ObjectStreamSize);
+									nextStreamPositionEmbedded += *site->ObjectStreamSize;
+								}
 							}
 
 							CP_XML_NODE(L"Site")
diff --git a/MsBinaryFile/DocFile/MemoryStream.cpp b/MsBinaryFile/DocFile/MemoryStream.cpp
index e083216c77..893243f7c6 100644
--- a/MsBinaryFile/DocFile/MemoryStream.cpp
+++ b/MsBinaryFile/DocFile/MemoryStream.cpp
@@ -198,6 +198,8 @@ void MemoryStream::WriteBytes(unsigned char* pData, int size)
 
 unsigned long MemoryStream::GetPosition() const
 {
+	if (m_Position > m_Size)
+		return m_Size;
 	return m_Position;
 }
 unsigned long MemoryStream::GetSize() const
diff --git a/OOXML/DocxFormat/Media/ActiveX.cpp b/OOXML/DocxFormat/Media/ActiveX.cpp
index 6f27a41e54..c584a4583c 100644
--- a/OOXML/DocxFormat/Media/ActiveX.cpp
+++ b/OOXML/DocxFormat/Media/ActiveX.cpp
@@ -551,6 +551,8 @@ xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\""
 		
 		bool fCompressed = GETBIT(CountOfCharsWithCompressionFlag, 31);
 		size_t size = GETBITS(CountOfCharsWithCompressionFlag, 0, 30);
+		
+		if (size > 0xfff0) return L"";
 
 		if (stream->GetPosition() + size > stream->GetSize())
 		{