Merge pull request #566 from ONLYOFFICE/fix/v6.2.2-fix-bugs

fix bug #49434;...

ASCOfficeDocFile/DocDocxConverter/MemoryStream.h

@@ -80,7 +80,7 @@ public:
 	}
 	void WriteUInt16(unsigned short val)
 	{
-		if (m_Data)
+		if (m_Data && (m_Position + sizeof(unsigned short) <= m_Size))
 		{
 			((unsigned short *)(m_Data + m_Position))[0] = val;
 			m_Position	+=	sizeof(unsigned short);
@@ -113,7 +113,7 @@ public:
 	}
 	void WriteInt32(_INT32 val)
 	{
-		if (m_Data)
+		if (m_Data && (m_Position + sizeof(_INT32) <= m_Size))
 		{
 			((_INT32 *)(m_Data + m_Position))[0] = val;
 			m_Position	+=	sizeof(_INT32);
@@ -133,7 +133,7 @@ public:
 	}
 	void WriteByte(unsigned char val)
 	{
-		if (m_Data)
+		if (m_Data && (m_Position + 1 <= m_Size))
 		{
 			m_Data[m_Position] = val;
 			m_Position	+= 1;
@@ -141,7 +141,7 @@ public:
 	}
 	void WriteUInt32(_UINT32 val)
 	{
-		if (m_Data)
+		if (m_Data && (m_Position + sizeof(_UINT32) <= m_Size))
 		{
 			((_UINT32 *)(m_Data + m_Position))[0] = val;
 			m_Position	+=	sizeof(_UINT32);
@@ -190,7 +190,7 @@ public:
 	}
 	void WriteBytes(unsigned char* pData, int size)
 	{
-		if (m_Data)
+		if (m_Data && (m_Position + size <= m_Size))
 		{
 			memcpy(m_Data + m_Position, pData, size);
 			m_Position += size;

ASCOfficeDocFile/DocDocxConverter/SectionPropertiesMapping.cpp

@@ -352,10 +352,10 @@ namespace DocFileFormat
 			case sprmOldSCcolumns:
 			case sprmSCcolumns:
 			{
-				m_nColumns				=	static_cast<int> (FormatUtils::BytesToInt16 (iter->Arguments, 0, iter->argumentsSize) + 1);
+				m_nColumns = static_cast<int> (FormatUtils::BytesToInt16 (iter->Arguments, 0, iter->argumentsSize) + 1);
 
 				RELEASEARRAYOBJECTS (m_arrSpace);					
-				m_arrSpace				=	new short [m_nColumns];
+				m_arrSpace = new short [m_nColumns];
 
                 appendValueAttribute (&cols, L"w:num", FormatUtils::IntToWideString (m_nColumns));
 			}
@@ -388,10 +388,13 @@ namespace DocFileFormat
 				if (m_nColumns)
 				{
 					if (NULL == m_arrSpace)
-						m_arrSpace			=	new short[m_nColumns];
+						m_arrSpace = new short[m_nColumns];
 
-					unsigned char nInd		=	iter->Arguments[0];
-					m_arrSpace [nInd]		=	FormatUtils::BytesToInt16 (iter->Arguments, 1, iter->argumentsSize);
+					unsigned char nInd = iter->Arguments[0];
+					if (nInd < m_nColumns)
+					{
+						m_arrSpace[nInd] = FormatUtils::BytesToInt16(iter->Arguments, 1, iter->argumentsSize);
+					}
 				}
 			}break;
 

ASCOfficeOdfFileW/source/OdfFormat/odf_style_context.cpp

@@ -49,7 +49,7 @@ namespace cpdoccore {
 
 namespace odf_writer {
 
-static int style_family_counts_[26]={};//согласно количеству разных стилей
+static int style_family_counts_[1024]={};//согласно количеству разных стилей
 
 
 void calc_paragraph_properties_content(std::vector<style_paragraph_properties*> & parProps, paragraph_format_properties * result)

ASCOfficeOdfFileW/source/Oox2OdfConverter/PptxConverter.cpp

@@ -88,7 +88,7 @@ PptxConverter::PptxConverter(const std::wstring & path, bool bTemplate)
 	pptx_document = new PPTX::Document();
 	if (!pptx_document->isValid(oox_path.GetPath())) // true ???
 	{
-		delete pptx_document;
+		delete pptx_document; pptx_document = NULL;
 		return;
 	}
 
@@ -97,7 +97,7 @@ PptxConverter::PptxConverter(const std::wstring & path, bool bTemplate)
 	smart_ptr<PPTX::Presentation> presentation_ptr = pptx_document->Get(OOX::Presentation::FileTypes::Presentation).smart_dynamic_cast<PPTX::Presentation>();
 	if (!presentation_ptr.is_init())
 	{
-		delete pptx_document;
+		delete pptx_document;  pptx_document = NULL;
 		return;
 	}
 	presentation = presentation_ptr.GetPointer();

ASCOfficePPTFile/PPTFormatLib/Records/Drawing/ArtBlip.cpp

@@ -68,14 +68,18 @@ void CRecordOfficeArtBlip::ReadFromStream(SRecordHeader & oHeader, POLE::Stream*
 
 			oMetaFile.SetHeader(NULL, 0);
 
-			BYTE* pData = new BYTE[oHeader.RecLen - lOffset];
-			pStream->read(pData, oHeader.RecLen - lOffset); 
-			if (pDecryptor)
+			int nDataSize = oHeader.RecLen - lOffset;
+			BYTE* pData = (nDataSize > 0 && nDataSize < 0xffffff ) ? (new BYTE[nDataSize]) : NULL;
+			
+			if (pData)
 			{
-				pDecryptor->Decrypt((char*)pData, oHeader.RecLen - lOffset, 0);
+				pStream->read(pData, oHeader.RecLen - lOffset);
+				if (pDecryptor)
+				{
+					pDecryptor->Decrypt((char*)pData, oHeader.RecLen - lOffset, 0);
+				}
+				oMetaFile.SetData(pData, oMetaHeader.cbSave, oMetaHeader.cbSize, (bool)(oMetaHeader.compression != 0xFE));
 			}
-			oMetaFile.SetData(pData, oMetaHeader.cbSave, oMetaHeader.cbSize, (bool)(oMetaHeader.compression != 0xFE) );
-
 		}break;
 		case RECORD_TYPE_ESCHER_BLIP_WMF:
 		{

ASCOfficePPTFile/PPTFormatLib/Records/ExOleObjAtom.h

@@ -104,6 +104,7 @@ public:
 			else
 			{
 				delete []pData;
+				pData = NULL;
 			}
 		}			
 		//if (pDecryptor)

ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp

@@ -228,9 +228,13 @@ namespace NSBinPptxRW
 		std::wstring strExts = _T(".jpg");
 		//use GetFileName to avoid defining '.' in the directory as extension
 		std::wstring strFileName = NSFile::GetFileName(strInput);
-		int nIndexExt = (int)strFileName.rfind(wchar_t('.'));
-		if (-1 != nIndexExt)
-			strExts = strFileName.substr(nIndexExt);
+		int sizeExt = (int)strFileName.rfind(wchar_t('.'));
+		if (-1 != sizeExt)
+		{
+			strExts = strFileName.substr(sizeExt);
+			sizeExt = (int)strFileName.length() - sizeExt;
+		}
+		else sizeExt = 0;
 
 		int	typeAdditional = 0;
 		std::wstring strAdditional;
@@ -238,14 +242,14 @@ namespace NSBinPptxRW
 
 		int nDisplayType = IsDisplayedImage(strInput);
 		size_t nFileNameLength = strFileName.length();
-		if (0 != nDisplayType && nFileNameLength > 4)
+		if (0 != nDisplayType && nFileNameLength > sizeExt)
 		{
 			OOX::CPath oPath = strInput;
 			
 			std::wstring strFolder		= oPath.GetDirectory();
 			std::wstring strFileName	= oPath.GetFilename();
 
-			strFileName.erase(strFileName.length() - 4, 4);
+			strFileName.erase(strFileName.length() - sizeExt, sizeExt);
 
 			if(0 != (nDisplayType & 1))
 			{
@@ -682,7 +686,13 @@ namespace NSBinPptxRW
 			{
 				while (nNewSize >= m_lSize)
 				{
-					m_lSize *= 2;
+					unsigned int lSize = m_lSize * 2;
+					if (lSize < m_lSize)
+					{
+						m_lSize = nNewSize;
+						break;
+					}
+					m_lSize = lSize;
 				}
 
 				BYTE* pNew = new BYTE[m_lSize];
@@ -696,8 +706,8 @@ namespace NSBinPptxRW
 		}
 		else
 		{
-			m_lSize		= 1024 * 1024; // 1Mb
-			m_pStreamData	= new BYTE[m_lSize];
+			m_lSize = 1024 * 1024; // 1Mb
+			m_pStreamData = new BYTE[m_lSize];
 
 			m_lPosition = 0;
 			m_pStreamCur = m_pStreamData;

ASCOfficePPTXFile/PPTXFormat/Logic/Fills/BlipFill.cpp

@@ -325,8 +325,7 @@ namespace PPTX
 
 									if (false == detectImageExtension.empty())
 									{
-										if (sImageExtension.empty())
-											sImageExtension = detectImageExtension;
+										sImageExtension = detectImageExtension;
 
 										//папки media может не быть в случае, когда все картинки base64(поскольку файл временный, папку media не создаем)
 										std::wstring tempFilePath = pReader->m_strFolder + FILE_SEPARATOR_STR;

ASCOfficePPTXFile/PPTXFormat/Logic/TextFont.h

@@ -232,7 +232,7 @@ namespace PPTX
 				pWriter->StartNode(m_name);				
 				
 				pWriter->StartAttributes();
-				pWriter->WriteAttribute(_T("typeface"), typeface);
+				pWriter->WriteAttribute(_T("typeface"), XmlUtils::EncodeXmlString(typeface));
 				pWriter->WriteAttribute(_T("pitchFamily"), pitchFamily);
 				pWriter->WriteAttribute(_T("charset"), charset);
 				pWriter->WriteAttribute(_T("panose"), panose);

ASCOfficePPTXFile/PPTXFormat/Logic/UniFill.cpp

@@ -338,8 +338,7 @@ namespace PPTX
 
 													if (false == detectImageExtension.empty())
 													{
-														if (sImageExtension.empty())
-															sImageExtension = detectImageExtension;
+														sImageExtension = detectImageExtension;
 
 														//папки media может не быть в случае, когда все картинки base64(поскольку файл временный, папку media не создаем)
 														std::wstring tempFilePath = pReader->m_strFolder + FILE_SEPARATOR_STR;

XlsxSerializerCom/Writer/BinaryReader.cpp

@@ -6870,7 +6870,8 @@ int BinaryFileReader::ReadFile(const std::wstring& sSrcFileName, std::wstring sD
 		int nType = 0;
 		std::string version = "";
 		std::string dst_len = "";
-		while (true)
+		
+		while (nIndex < nBase64DataSize)
 		{
 			nIndex++;
 			BYTE _c = pBase64Data[nIndex];