simon987/antiword
1
0
Fork 0
mirror of https://github.com/simon987/antiword.git synced 2025-04-04 07:53:00 +00:00
Code Issues Projects Releases Wiki Activity

Add more bounds checking

Browse Source
This commit is contained in:
simon987 2022-03-17 15:07:32 -04:00
parent 62ae66db99
commit b9afdb0561
6 changed files with 1349 additions and 1313 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/antiword.h
View File

@ -253,7 +253,7 @@
#define BUF_AUC 1
extern void setBufferSize(ULONG size);
extern BOOL isOutOfBounds(ULONG offset);
extern BOOL isOutOfBounds(ULONG offset, size_t size);
/* Prototypes */

21
src/pdf.c
View File

@ -514,6 +514,7 @@ vMove2NextPage(diagram_type *pDiag, BOOL bNewSection)
vAddHeader(pDiag);
} /* end of vMove2NextPage */
#define VMOVETO_MAX_DEPTH 300
/*
* vMoveTo - move to the specified X,Y coordinates
*
@ -527,7 +528,24 @@ vMoveTo(diagram_type *pDiag, long lLastVerticalMovement)
fail(pDiag->pOutFile == NULL);
if (pDiag->lYtop <= lFooterHeight + PS_BOTTOM_MARGIN && !bInFtrSpace) {
vMove2NextPage(pDiag, FALSE);
// NOTE: SIST2: only output the first page
vAddFooter(pDiag);
vEndPageObject(pDiag->pOutFile);
iObjectNumberCurr++;
vSetLocation(iObjectNumberCurr);
vFillNextPageObject();
vFPprintf(pDiag->pOutFile, "%d 0 obj\n", iObjectNumberCurr);
vFPprintf(pDiag->pOutFile, "<<\n");
vFPprintf(pDiag->pOutFile, "/Type /Page\n");
vFPprintf(pDiag->pOutFile, "/Parent 3 0 R\n");
vFPprintf(pDiag->pOutFile, "/Resources 17 0 R\n");
vFPprintf(pDiag->pOutFile, "/Contents %d 0 R\n", iObjectNumberCurr + 1);
vFPprintf(pDiag->pOutFile, ">>\n");
vFPprintf(pDiag->pOutFile, "endobj\n");
// ^^^
/* Repeat the last vertical movement on the new page */
pDiag->lYtop -= lLastVerticalMovement;
}
@ -978,6 +996,7 @@ static void
vPrintPDF(FILE *pFile, const char *szString, size_t tStringLength,
USHORT usFontstyle)
{
const UCHAR *aucBytes;
double dMove;
size_t tCount;

217
src/prop8.c
View File

@ -22,27 +22,34 @@
* iGet8InfoLength - the length of the information for Word 8/9/10/11 files
*/
static int
iGet8InfoLength(int iByteNbr, const UCHAR *aucGrpprl)
{
iGet8InfoLength(int iByteNbr, const UCHAR *aucGrpprl) {
int iTmp, iDel, iAdd;
USHORT usOpCode;
usOpCode = usGetWord(iByteNbr, aucGrpprl);
switch (usOpCode & 0xe000) {
case 0x0000: case 0x2000:
case 0x0000:
case 0x2000:
return 3;
case 0x4000: case 0x8000: case 0xa000:
case 0x4000:
case 0x8000:
case 0xa000:
return 4;
case 0xe000:
return 5;
case 0x6000:
return 6;
case 0xc000:
iTmp = (int)ucGetByte(iByteNbr + 2, aucGrpprl);
// HOTFIX for buffer overflow (fuzzing)
if (iByteNbr + 2 >= sizeof(section_block_type) - 1) {
return 1;
}
iTmp = (int) ucGetByte(iByteNbr + 2, aucGrpprl);
if (usOpCode == 0xc615 && iTmp == 255) {
iDel = (int)ucGetByte(iByteNbr + 3, aucGrpprl);
iAdd = (int)ucGetByte(
iDel = (int) ucGetByte(iByteNbr + 3, aucGrpprl);
iAdd = (int) ucGetByte(
iByteNbr + 4 + iDel * 4, aucGrpprl);
iTmp = 2 + iDel * 4 + iAdd * 3;
}
@ -63,8 +70,7 @@ static UCHAR *
aucFillInfoBuffer(FILE *pFile, const pps_type *pTable,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
ULONG ulBeginInfo, size_t tInfoLen)
{
ULONG ulBeginInfo, size_t tInfoLen) {
const ULONG *aulBlockDepot;
UCHAR *aucBuffer;
size_t tBlockDepotLen, tBlockSize;
@ -108,8 +114,7 @@ void
vGet8DopInfo(FILE *pFile, const pps_type *pTable,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
document_block_type tDocument;
UCHAR *aucBuffer;
ULONG ulBeginDocpInfo, ulTmp;
@ -121,7 +126,7 @@ vGet8DopInfo(FILE *pFile, const pps_type *pTable,
ulBeginDocpInfo = ulGetLong(0x192, aucHeader); /* fcDop */
NO_DBG_HEX(ulBeginSectInfo);
tDocpInfoLen = (size_t)ulGetLong(0x196, aucHeader); /* lcbDop */
tDocpInfoLen = (size_t) ulGetLong(0x196, aucHeader); /* lcbDop */
NO_DBG_DEC(tSectInfoLen);
if (tDocpInfoLen < 28) {
DBG_MSG("No Document information");
@ -136,7 +141,7 @@ vGet8DopInfo(FILE *pFile, const pps_type *pTable,
}
usTmp = usGetWord(0x00, aucBuffer);
tDocument.ucHdrFtrSpecification = (UCHAR)(usTmp >> 8); /* grpfIhdt */
tDocument.ucHdrFtrSpecification = (UCHAR) (usTmp >> 8); /* grpfIhdt */
tDocument.usDefaultTabWidth = usGetWord(0x0a, aucBuffer); /* dxaTab */
ulTmp = ulGetLong(0x14, aucBuffer); /* dttmCreated */
tDocument.tCreateDate = tConvertDTTM(ulTmp);
@ -153,8 +158,7 @@ vGet8DopInfo(FILE *pFile, const pps_type *pTable,
*/
static void
vGet8SectionInfo(const UCHAR *aucGrpprl, size_t tBytes,
section_block_type *pSection)
{
section_block_type *pSection) {
UINT uiIndex;
int iFodoOff, iInfoLen, iSize, iTmp;
USHORT usCcol;
@ -163,7 +167,7 @@ vGet8SectionInfo(const UCHAR *aucGrpprl, size_t tBytes,
fail(aucGrpprl == NULL || pSection == NULL);
iFodoOff = 0;
while (tBytes >= (size_t)iFodoOff + 2) {
while (tBytes >= (size_t) iFodoOff + 2) {
iInfoLen = 0;
switch (usGetWord(iFodoOff, aucGrpprl)) {
case 0x3009: /* bkc */
@ -180,7 +184,7 @@ vGet8SectionInfo(const UCHAR *aucGrpprl, size_t tBytes,
DBG_DEC(usCcol);
break;
case 0xd202: /* olstAnm */
iSize = (int)ucGetByte(iFodoOff + 2, aucGrpprl);
iSize = (int) ucGetByte(iFodoOff + 2, aucGrpprl);
DBG_DEC_C(iSize != 212, iSize);
for (uiIndex = 0, iTmp = iFodoOff + 3;
uiIndex < 9 && iTmp < iFodoOff + 3 + iSize - 15;
@ -192,11 +196,11 @@ vGet8SectionInfo(const UCHAR *aucGrpprl, size_t tBytes,
DBG_HEX(ucTmp);
if ((ucTmp & BIT(2)) != 0) {
pSection->usNeedPrevLvl |=
(USHORT)BIT(uiIndex);
(USHORT) BIT(uiIndex);
}
if ((ucTmp & BIT(3)) != 0) {
pSection->usHangingIndent |=
(USHORT)BIT(uiIndex);
(USHORT) BIT(uiIndex);
}
}
DBG_HEX(pSection->usNeedPrevLvl);
@ -220,8 +224,7 @@ void
vGet8SepInfo(FILE *pFile, const pps_info_type *pPPS,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
section_block_type tSection;
ULONG *aulSectPage, *aulCharPos;
UCHAR *aucBuffer, *aucFpage;
@ -236,7 +239,7 @@ vGet8SepInfo(FILE *pFile, const pps_info_type *pPPS,
NO_DBG_HEX(ulBeginOfText);
ulBeginSectInfo = ulGetLong(0xca, aucHeader); /* fcPlcfsed */
NO_DBG_HEX(ulBeginSectInfo);
tSectInfoLen = (size_t)ulGetLong(0xce, aucHeader); /* lcbPlcfsed */
tSectInfoLen = (size_t) ulGetLong(0xce, aucHeader); /* lcbPlcfsed */
NO_DBG_DEC(tSectInfoLen);
if (tSectInfoLen < 4) {
DBG_DEC(tSectInfoLen);
@ -285,7 +288,7 @@ vGet8SepInfo(FILE *pFile, const pps_info_type *pPPS,
aucTmp, aulSectPage[tIndex], 2)) {
continue;
}
tBytes = 2 + (size_t)usGetWord(0, aucTmp);
tBytes = 2 + (size_t) usGetWord(0, aucTmp);
NO_DBG_DEC(tBytes);
/* Read the bytes */
aucFpage = xmalloc(tBytes);
@ -313,8 +316,7 @@ void
vGet8HdrFtrInfo(FILE *pFile, const pps_type *pTable,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
ULONG *aulCharPos;
UCHAR *aucBuffer;
ULONG ulHdrFtrOffset, ulBeginHdrFtrInfo;
@ -325,7 +327,7 @@ vGet8HdrFtrInfo(FILE *pFile, const pps_type *pTable,
ulBeginHdrFtrInfo = ulGetLong(0xf2, aucHeader); /* fcPlcfhdd */
NO_DBG_HEX(ulBeginHdrFtrInfo);
tHdrFtrInfoLen = (size_t)ulGetLong(0xf6, aucHeader); /* lcbPlcfhdd */
tHdrFtrInfoLen = (size_t) ulGetLong(0xf6, aucHeader); /* lcbPlcfhdd */
NO_DBG_DEC(tHdrFtrInfoLen);
if (tHdrFtrInfoLen < 8) {
DBG_DEC_C(tHdrFtrInfoLen != 0, tHdrFtrInfoLen);
@ -363,8 +365,7 @@ vGet8HdrFtrInfo(FILE *pFile, const pps_type *pTable,
*/
row_info_enum
eGet8RowInfo(int iFodo,
const UCHAR *aucGrpprl, int iBytes, row_block_type *pRow)
{
const UCHAR *aucGrpprl, int iBytes, row_block_type *pRow) {
int iFodoOff, iInfoLen;
int iIndex, iSize, iCol;
int iPosCurr, iPosPrev;
@ -387,6 +388,12 @@ eGet8RowInfo(int iFodo,
bFoundd608 = FALSE;
while (iBytes >= iFodoOff + 2) {
iInfoLen = 0;
// HOTFIX for buffer overflow (fuzzing)
if (iFodo + iFodoOff >= BIG_BLOCK_SIZE - 4) {
break;
}
switch (usGetWord(iFodo + iFodoOff, aucGrpprl)) {
case 0x2416: /* fInTable */
if (odd(ucGetByte(iFodo + iFodoOff + 2, aucGrpprl))) {
@ -458,18 +465,18 @@ eGet8RowInfo(int iFodo,
break;
case 0xd606: /* cDefTable10 */
DBG_MSG("0xd606: sprmTDefTable10");
iSize = (int)usGetWord(iFodo + iFodoOff + 2, aucGrpprl);
iSize = (int) usGetWord(iFodo + iFodoOff + 2, aucGrpprl);
DBG_DEC(iSize);
break;
case 0xd608: /* cDefTable */
iSize = (int)usGetWord(iFodo + iFodoOff + 2, aucGrpprl);
iSize = (int) usGetWord(iFodo + iFodoOff + 2, aucGrpprl);
if (iSize < 6 || iBytes < iFodoOff + 8) {
DBG_DEC(iSize);
DBG_DEC(iFodoOff);
iInfoLen = 2;
break;
}
iCol = (int)ucGetByte(iFodo + iFodoOff + 4, aucGrpprl);
iCol = (int) ucGetByte(iFodo + iFodoOff + 4, aucGrpprl);
if (iCol < 1 ||
iBytes < iFodoOff + 4 + (iCol + 1) * 2) {
DBG_DEC(iCol);
@ -477,21 +484,21 @@ eGet8RowInfo(int iFodo,
iInfoLen = 2;
break;
}
if (iCol >= (int)elementsof(pRow->asColumnWidth)) {
if (iCol >= (int) elementsof(pRow->asColumnWidth)) {
DBG_DEC(iCol);
return found_nothing;
// werr(1, "The number of columns is corrupt");
}
pRow->ucNumberOfColumns = (UCHAR)iCol;
iPosPrev = (int)(short)usGetWord(
pRow->ucNumberOfColumns = (UCHAR) iCol;
iPosPrev = (int) (short) usGetWord(
iFodo + iFodoOff + 5,
aucGrpprl);
for (iIndex = 0; iIndex < iCol; iIndex++) {
iPosCurr = (int)(short)usGetWord(
iPosCurr = (int) (short) usGetWord(
iFodo + iFodoOff + 7 + iIndex * 2,
aucGrpprl);
pRow->asColumnWidth[iIndex] =
(short)(iPosCurr - iPosPrev);
(short) (iPosCurr - iPosPrev);
iPosPrev = iPosCurr;
}
bFoundd608 = TRUE;
@ -528,8 +535,7 @@ eGet8RowInfo(int iFodo,
*/
void
vGet8StyleInfo(int iFodo,
const UCHAR *aucGrpprl, int iBytes, style_block_type *pStyle)
{
const UCHAR *aucGrpprl, int iBytes, style_block_type *pStyle) {
list_block_type tList6;
const list_block_type *pList;
int iFodoOff, iInfoLen;
@ -542,11 +548,17 @@ vGet8StyleInfo(int iFodo,
NO_DBG_DEC_C(pStyle->usListIndex != 0, pStyle->usIstd);
NO_DBG_DEC_C(pStyle->usListIndex != 0, pStyle->usListIndex);
(void)memset(&tList6, 0, sizeof(tList6));
(void) memset(&tList6, 0, sizeof(tList6));
iFodoOff = 0;
while (iBytes >= iFodoOff + 2) {
iInfoLen = 0;
// HOTFIX for buffer overflow (fuzzing)
if (iFodo + iFodoOff >= BIG_BLOCK_SIZE - 4) {
break;
}
usOpCode = usGetWord(iFodo + iFodoOff, aucGrpprl);
switch (usOpCode) {
case 0x2403: /* jc */
@ -569,7 +581,7 @@ vGet8StyleInfo(int iFodo,
NO_DBG_DEC(pStyle->usListIndex);
break;
case 0x4610: /* Nest dxaLeft */
sTmp = (short)usGetWord(
sTmp = (short) usGetWord(
iFodo + iFodoOff + 2, aucGrpprl);
pStyle->sLeftIndent += sTmp;
if (pStyle->sLeftIndent < 0) {
@ -580,19 +592,19 @@ vGet8StyleInfo(int iFodo,
break;
case 0xc60d: /* ChgTabsPapx */
case 0xc615: /* ChgTabs */
iTmp = (int)ucGetByte(iFodo + iFodoOff + 2, aucGrpprl);
iTmp = (int) ucGetByte(iFodo + iFodoOff + 2, aucGrpprl);
if (iTmp < 2) {
iInfoLen = 1;
break;
}
NO_DBG_DEC(iTmp);
iDel = (int)ucGetByte(iFodo + iFodoOff + 3, aucGrpprl);
iDel = (int) ucGetByte(iFodo + iFodoOff + 3, aucGrpprl);
if (iTmp < 2 + 2 * iDel) {
iInfoLen = 1;
break;
}
NO_DBG_DEC(iDel);
iAdd = (int)ucGetByte(
iAdd = (int) ucGetByte(
iFodo + iFodoOff + 4 + 2 * iDel, aucGrpprl);
if (iTmp < 2 + 2 * iDel + 2 * iAdd) {
iInfoLen = 1;
@ -601,17 +613,17 @@ vGet8StyleInfo(int iFodo,
NO_DBG_DEC(iAdd);
break;
case 0x840e: /* dxaRight */
pStyle->sRightIndent = (short)usGetWord(
pStyle->sRightIndent = (short) usGetWord(
iFodo + iFodoOff + 2, aucGrpprl);
NO_DBG_DEC(pStyle->sRightIndent);
break;
case 0x840f: /* dxaLeft */
pStyle->sLeftIndent = (short)usGetWord(
pStyle->sLeftIndent = (short) usGetWord(
iFodo + iFodoOff + 2, aucGrpprl);
NO_DBG_DEC(pStyle->sLeftIndent);
break;
case 0x8411: /* dxaLeft1 */
pStyle->sLeftIndent1 = (short)usGetWord(
pStyle->sLeftIndent1 = (short) usGetWord(
iFodo + iFodoOff + 2, aucGrpprl);
NO_DBG_DEC(pStyle->sLeftIndent1);
break;
@ -626,7 +638,7 @@ vGet8StyleInfo(int iFodo,
NO_DBG_DEC(pStyle->usAfterIndent);
break;
case 0xc63e: /* anld */
iTmp = (int)ucGetByte(
iTmp = (int) ucGetByte(
iFodo + iFodoOff + 2, aucGrpprl);
DBG_DEC_C(iTmp < 84, iTmp);
if (iTmp >= 1) {
@ -634,13 +646,13 @@ vGet8StyleInfo(int iFodo,
iFodo + iFodoOff + 3, aucGrpprl);
}
if (tList6.ucNFC != LIST_BULLETS && iTmp >= 2) {
iBefore = (int)ucGetByte(
iBefore = (int) ucGetByte(
iFodo + iFodoOff + 4, aucGrpprl);
} else {
iBefore = 0;
}
if (iTmp >= 12) {
tList6.ulStartAt = (ULONG)usGetWord(
tList6.ulStartAt = (ULONG) usGetWord(
iFodo + iFodoOff + 13, aucGrpprl);
}
if (iTmp >= iBefore + 22) {
@ -664,7 +676,7 @@ vGet8StyleInfo(int iFodo,
if (pStyle->usListIndex == 2047) {
/* Old style list */
pStyle->usStartAt = (USHORT)tList6.ulStartAt;
pStyle->usStartAt = (USHORT) tList6.ulStartAt;
pStyle->usListChar = tList6.usListChar;
pStyle->ucNFC = tList6.ucNFC;
} else {
@ -672,8 +684,8 @@ vGet8StyleInfo(int iFodo,
pList = pGetListInfo(pStyle->usListIndex, pStyle->ucListLevel);
if (pList != NULL) {
pStyle->bNoRestart = pList->bNoRestart;
fail(pList->ulStartAt > (ULONG)USHRT_MAX);
pStyle->usStartAt = (USHORT)pList->ulStartAt;
fail(pList->ulStartAt > (ULONG) USHRT_MAX);
pStyle->usStartAt = (USHORT) pList->ulStartAt;
pStyle->usListChar = pList->usListChar;
pStyle->ucNFC = pList->ucNFC;
if (pStyle->sLeftIndent <= 0) {
@ -689,21 +701,20 @@ vGet8StyleInfo(int iFodo,
* Returns the value when found, otherwise 0
*/
static short
sGetLeftIndent(const UCHAR *aucGrpprl, size_t tBytes)
{
sGetLeftIndent(const UCHAR *aucGrpprl, size_t tBytes) {
int iOffset, iInfoLen;
USHORT usOpCode, usTmp;
fail(aucGrpprl == NULL);
iOffset = 0;
while (tBytes >= (size_t)iOffset + 4) {
while (tBytes >= (size_t) iOffset + 4) {
usOpCode = usGetWord(iOffset, aucGrpprl);
if (usOpCode == 0x840f) { /* dxaLeft */
usTmp = usGetWord(iOffset + 2, aucGrpprl);
if (usTmp <= 0x7fff) {
NO_DBG_DEC(usTmp);
return (short)usTmp;
return (short) usTmp;
}
}
iInfoLen = iGet8InfoLength(iOffset, aucGrpprl);
@ -720,8 +731,7 @@ void
vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
list_block_type tList;
const ULONG *aulBlockDepot;
UCHAR *aucLfoInfo, *aucLstfInfo, *aucPapx, *aucXString;
@ -760,7 +770,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
/* LFO (List Format Override) */
ulBeginLfoInfo = ulGetLong(0x2ea, aucHeader); /* fcPlfLfo */
DBG_HEX(ulBeginLfoInfo);
tLfoInfoLen = (size_t)ulGetLong(0x2ee, aucHeader); /* lcbPlfLfo */
tLfoInfoLen = (size_t) ulGetLong(0x2ee, aucHeader); /* lcbPlfLfo */
DBG_DEC(tLfoInfoLen);
if (tLfoInfoLen == 0) {
DBG_MSG("No lists in this document");
@ -781,7 +791,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
/* LSTF (LiST data on File) */
ulBeginLstfInfo = ulGetLong(0x2e2, aucHeader); /* fcPlcfLst */
DBG_HEX(ulBeginLstfInfo);
tLstfInfoLen = (size_t)ulGetLong(0x2e6, aucHeader); /* lcbPlcfLst */
tLstfInfoLen = (size_t) ulGetLong(0x2e6, aucHeader); /* lcbPlcfLst */
DBG_DEC(tLstfInfoLen);
if (tLstfInfoLen == 0) {
DBG_MSG("No list data on file");
@ -797,7 +807,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
}
NO_DBG_PRINT_BLOCK(aucLstfInfo, tLstfInfoLen);
tLstfRecords = (size_t)usGetWord(0, aucLstfInfo);
tLstfRecords = (size_t) usGetWord(0, aucLstfInfo);
if (2 + tLstfRecords * 28 < tLstfInfoLen) {
DBG_DEC(2 + tLstfRecords * 28);
DBG_DEC(tLstfInfoLen);
@ -822,11 +832,11 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
for (ucListLevel = 0; ucListLevel < ucMaxLevel; ucListLevel++) {
fail(aucXString != NULL);
usIstd = usGetWord(
tStart + 8 + 2 * (size_t)ucListLevel,
tStart + 8 + 2 * (size_t) ucListLevel,
aucLstfInfo);
DBG_DEC_C(usIstd != STI_NIL, usIstd);
NO_DBG_HEX(ulStart);
(void)memset(&tList, 0, sizeof(tList));
(void) memset(&tList, 0, sizeof(tList));
/* Read the lvlf (List leVeL on File) */
if (!bReadBuffer(pFile, pPPS->tTable.ulSB,
aulBlockDepot, tBlockDepotLen,
@ -849,7 +859,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
(ucTmp & BIT(6)) != 0, "Found one");
}
ulStart += sizeof(aucLvlfInfo);
tPapxLen = (size_t)ucGetByte(25, aucLvlfInfo);
tPapxLen = (size_t) ucGetByte(25, aucLvlfInfo);
if (tPapxLen != 0) {
aucPapx = xmalloc(tPapxLen);
/* Read the Papx */
@ -868,7 +878,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
}
ulStart += tPapxLen;
ucChpxLen = ucGetByte(24, aucLvlfInfo);
ulStart += (ULONG)ucChpxLen;
ulStart += (ULONG) ucChpxLen;
/* Read the length of the XString */
if (!bReadBuffer(pFile, pPPS->tTable.ulSB,
aulBlockDepot, tBlockDepotLen,
@ -878,7 +888,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
return;
}
NO_DBG_PRINT_BLOCK(aucXst, sizeof(aucXst));
tXstLen = (size_t)usGetWord(0, aucXst);
tXstLen = (size_t) usGetWord(0, aucXst);
ulStart += sizeof(aucXst);
if (tXstLen == 0) {
tList.usListChar = DEFAULT_LISTCHAR;
@ -906,7 +916,7 @@ vGet8LstInfo(FILE *pFile, const pps_info_type *pPPS,
if (ucTmp == 0) {
break;
}
tOff = (size_t)ucTmp;
tOff = (size_t) ucTmp;
}
tOff *= 2; /* Offset in chars to offset in bytes */
NO_DBG_DEC(tOff);
@ -937,8 +947,7 @@ void
vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
row_block_type tRow;
style_block_type tStyle;
ULONG *aulParfPage;
@ -956,7 +965,7 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
ulBeginParfInfo = ulGetLong(0x102, aucHeader); /* fcPlcfbtePapx */
NO_DBG_HEX(ulBeginParfInfo);
tParfInfoLen = (size_t)ulGetLong(0x106, aucHeader); /* lcbPlcfbtePapx */
tParfInfoLen = (size_t) ulGetLong(0x106, aucHeader); /* lcbPlcfbtePapx */
NO_DBG_DEC(tParfInfoLen);
if (tParfInfoLen < 4) {
DBG_DEC(tParfInfoLen);
@ -974,7 +983,7 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
tLen = (tParfInfoLen / 4 - 1) / 2;
aulParfPage = xcalloc(tLen, sizeof(ULONG));
for (iIndex = 0, tOffset = (tLen + 1) * 4;
iIndex < (int)tLen;
iIndex < (int) tLen;
iIndex++, tOffset += 4) {
aulParfPage[iIndex] = ulGetLong(tOffset, aucBuffer);
NO_DBG_DEC(aulParfPage[iIndex]);
@ -983,9 +992,9 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
aucBuffer = xfree(aucBuffer);
NO_DBG_PRINT_BLOCK(aucHeader, HEADER_SIZE);
(void)memset(&tRow, 0, sizeof(tRow));
(void) memset(&tRow, 0, sizeof(tRow));
ulCharPosFirst = CP_INVALID;
for (iIndex = 0; iIndex < (int)tLen; iIndex++) {
for (iIndex = 0; iIndex < (int) tLen; iIndex++) {
fail(aulParfPage[iIndex] > ULONG_MAX / BIG_BLOCK_SIZE);
if (!bReadBuffer(pFile, pPPS->tWordDocument.ulSB,
aulBBD, tBBDLen, BIG_BLOCK_SIZE,
@ -995,20 +1004,31 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
break;
}
NO_DBG_PRINT_BLOCK(aucFpage, BIG_BLOCK_SIZE);
iRun = (int)ucGetByte(0x1ff, aucFpage);
iRun = (int) ucGetByte(0x1ff, aucFpage);
NO_DBG_DEC(iRun);
for (iIndex2 = 0; iIndex2 < iRun; iIndex2++) {
NO_DBG_HEX(ulGetLong(iIndex2 * 4, aucFpage));
iFodo = 2 * (int)ucGetByte(
// HOTFIX for buffer overflow (fuzzing)
if ((iRun + 1) * 4 + iIndex2 * 13 >= BIG_BLOCK_SIZE - 1) {
break;
}
iFodo = 2 * (int) ucGetByte(
(iRun + 1) * 4 + iIndex2 * 13, aucFpage);
if (iFodo <= 0) {
continue;
}
iLen = 2 * (int)ucGetByte(iFodo, aucFpage);
iLen = 2 * (int) ucGetByte(iFodo, aucFpage);
if (iLen == 0) {
iFodo++;
iLen = 2 * (int)ucGetByte(iFodo, aucFpage);
iLen = 2 * (int) ucGetByte(iFodo, aucFpage);
}
// HOTFIX for buffer overflow (fuzzing)
if (iFodo + 1 >= BIG_BLOCK_SIZE - sizeof(short)) {
break;
}
usIstd = usGetWord(iFodo + 1, aucFpage);
@ -1047,7 +1067,7 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
NO_DBG_HEX_C(tRow.ulFileOffsetEnd == FC_INVALID,
ulCharPosLast);
vAdd2RowInfoList(&tRow);
(void)memset(&tRow, 0, sizeof(tRow));
(void) memset(&tRow, 0, sizeof(tRow));
ulCharPosFirst = CP_INVALID;
break;
case found_nothing:
@ -1067,8 +1087,7 @@ vGet8PapInfo(FILE *pFile, const pps_info_type *pPPS,
*/
void
vGet8FontInfo(int iFodo, USHORT usIstd,
const UCHAR *aucGrpprl, int iBytes, font_block_type *pFont)
{
const UCHAR *aucGrpprl, int iBytes, font_block_type *pFont) {
long lTmp;
int iFodoOff, iInfoLen;
USHORT usFtc0, usFtc1, usFtc2, usTmp;
@ -1281,13 +1300,13 @@ vGet8FontInfo(int iFodo, USHORT usIstd,
break;
case 0xca4a: /* cHpsInc1 */
usTmp = usGetWord(iFodo + iFodoOff + 2, aucGrpprl);
lTmp = (long)pFont->usFontSize + (long)usTmp;
lTmp = (long) pFont->usFontSize + (long) usTmp;
if (lTmp < 8) {
pFont->usFontSize = 8;
} else if (lTmp > 32766) {
pFont->usFontSize = 32766;
} else {
pFont->usFontSize = (USHORT)lTmp;
pFont->usFontSize = (USHORT) lTmp;
}
break;
case 0xca4c: /* cMajority50 */
@ -1297,7 +1316,7 @@ vGet8FontInfo(int iFodo, USHORT usIstd,
ucTmp = ucGetByte(iFodo + iFodoOff + 2, aucGrpprl);
DBG_DEC(ucTmp);
if (ucTmp != 0) {
pFont->usFontSize = (USHORT)ucTmp;
pFont->usFontSize = (USHORT) ucTmp;
}
ucTmp = ucGetByte(iFodo + iFodoOff + 3, aucGrpprl);
DBG_DEC(ucTmp);
@ -1315,24 +1334,24 @@ vGet8FontInfo(int iFodo, USHORT usIstd,
NO_DBG_DEC_C(usFtc2 != USHRT_MAX, usFtc2);
NO_DBG_DEC_C(usFtc1 != USHRT_MAX, usFtc1);
if (usFtc0 <= 0x7fff) {
if (usFtc0 <= (USHORT)UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR)usFtc0;
if (usFtc0 <= (USHORT) UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR) usFtc0;
} else {
DBG_DEC(usFtc0);
DBG_FIXME();
pFont->ucFontNumber = 0;
}
} else if (usFtc2 <= 0x7fff) {
if (usFtc2 <= (USHORT)UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR)usFtc2;
if (usFtc2 <= (USHORT) UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR) usFtc2;
} else {
DBG_DEC(usFtc2);
DBG_FIXME();
pFont->ucFontNumber = 0;
}
} else if (usFtc1 <= 0x7fff) {
if (usFtc1 <= (USHORT)UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR)usFtc1;
if (usFtc1 <= (USHORT) UCHAR_MAX) {
pFont->ucFontNumber = (UCHAR) usFtc1;
} else {
DBG_DEC(usFtc1);
DBG_FIXME();
@ -1348,8 +1367,7 @@ vGet8FontInfo(int iFodo, USHORT usIstd,
*/
static BOOL
bGet8PicInfo(int iFodo,
const UCHAR *aucGrpprl, int iBytes, picture_block_type *pPicture)
{
const UCHAR *aucGrpprl, int iBytes, picture_block_type *pPicture) {
ULONG ulTmp;
int iFodoOff, iInfoLen;
BOOL bFound;
@ -1405,8 +1423,7 @@ void
vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
const ULONG *aulBBD, size_t tBBDLen,
const ULONG *aulSBD, size_t tSBDLen,
const UCHAR *aucHeader)
{
const UCHAR *aucHeader) {
font_block_type tFont;
picture_block_type tPicture;
ULONG *aulCharPage;
@ -1422,7 +1439,7 @@ vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
ulBeginCharInfo = ulGetLong(0xfa, aucHeader); /* fcPlcfbteChpx */
NO_DBG_HEX(ulBeginCharInfo);
tCharInfoLen = (size_t)ulGetLong(0xfe, aucHeader); /* lcbPlcfbteChpx */
tCharInfoLen = (size_t) ulGetLong(0xfe, aucHeader); /* lcbPlcfbteChpx */
NO_DBG_DEC(tCharInfoLen);
if (tCharInfoLen < 4) {
DBG_DEC(tCharInfoLen);
@ -1440,7 +1457,7 @@ vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
tLen = (tCharInfoLen / 4 - 1) / 2;
aulCharPage = xcalloc(tLen, sizeof(ULONG));
for (iIndex = 0, tOffset = (tLen + 1) * 4;
iIndex < (int)tLen;
iIndex < (int) tLen;
iIndex++, tOffset += 4) {
aulCharPage[iIndex] = ulGetLong(tOffset, aucBuffer);
NO_DBG_DEC(aulCharPage[iIndex]);
@ -1449,7 +1466,7 @@ vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
aucBuffer = xfree(aucBuffer);
NO_DBG_PRINT_BLOCK(aucHeader, HEADER_SIZE);
for (iIndex = 0; iIndex < (int)tLen; iIndex++) {
for (iIndex = 0; iIndex < (int) tLen; iIndex++) {
fail(aulCharPage[iIndex] > ULONG_MAX / BIG_BLOCK_SIZE);
if (!bReadBuffer(pFile, pPPS->tWordDocument.ulSB,
aulBBD, tBBDLen, BIG_BLOCK_SIZE,
@ -1459,15 +1476,15 @@ vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
break;
}
NO_DBG_PRINT_BLOCK(aucFpage, BIG_BLOCK_SIZE);
iRun = (int)ucGetByte(0x1ff, aucFpage);
iRun = (int) ucGetByte(0x1ff, aucFpage);
NO_DBG_DEC(iRun);
for (iIndex2 = 0; iIndex2 < iRun; iIndex2++) {
ulCharPos = ulGetLong(iIndex2 * 4, aucFpage);
ulFileOffset = ulCharPos2FileOffset(ulCharPos);
iFodo = 2 * (int)ucGetByte(
iFodo = 2 * (int) ucGetByte(
(iRun + 1) * 4 + iIndex2, aucFpage);
iLen = (int)ucGetByte(iFodo, aucFpage);
iLen = (int) ucGetByte(iFodo, aucFpage);
usIstd = usGetIstd(ulFileOffset);
vFillFontFromStylesheet(usIstd, &tFont);
@ -1482,7 +1499,7 @@ vGet8ChrInfo(FILE *pFile, const pps_info_type *pPPS,
continue;
}
(void)memset(&tPicture, 0, sizeof(tPicture));
(void) memset(&tPicture, 0, sizeof(tPicture));
if (bGet8PicInfo(iFodo, aucFpage + 1,
iLen - 1, &tPicture)) {
tPicture.ulFileOffset = ulFileOffset;

2
src/propmod.c
View File

@ -63,7 +63,7 @@ vAdd2PropModList(const UCHAR *aucPropMod)
NO_DBG_DEC(tNextFree);
tLen = 2 + (size_t)usGetWord(0, aucPropMod);
if (isOutOfBounds(tLen)) {
if (isOutOfBounds(tLen, sizeof(short))) {
return;
}
NO_DBG_HEX(tLen);

4
src/sist2_hotfix.c
View File

@ -2,8 +2,8 @@
static __thread ULONG buffer;
BOOL isOutOfBounds(ULONG offset) {
return offset > buffer;
BOOL isOutOfBounds(ULONG offset, size_t size) {
return offset >= buffer - size;
}
void setBufferSize(ULONG size) {

4
src/summary.c
View File

@ -220,7 +220,7 @@ vAnalyseSummaryInfo(const UCHAR *aucBuffer)
ulOffset = ulGetLong(12 + tIndex * 8, aucBuffer);
NO_DBG_DEC(tPropID);
NO_DBG_HEX(ulOffset);
if (isOutOfBounds(ulOffset)) {
if (isOutOfBounds(ulOffset, sizeof(long))) {
return FALSE;
}
tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);
@ -280,7 +280,7 @@ vAnalyseDocumentSummaryInfo(const UCHAR *aucBuffer)
ulOffset = ulGetLong(12 + tIndex * 8, aucBuffer);
NO_DBG_DEC(tPropID);
NO_DBG_HEX(ulOffset);
if (isOutOfBounds(ulOffset)) {
if (isOutOfBounds(ulOffset, sizeof(long))) {
return;
}
tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);