calligra/files/calligra-2.4.3-security-fix-buffer-overflow.patch

commit 7d72f7dd8d28d18c59a08a7d43bd4e0654043103
Author: Thorsten Zachmann <t.zachmann@zagge.de>
Date:   Sat Aug 4 06:42:14 2012 +0200

    Make sure not to write behind the allocated memory
    
    Validate the input data to not write behind the allocated memory. This fixes a
    buffer overflow found by Charlie Miller.
    (cherry picked from commit 8652ab672eaaa145dfb3782f5011de58aa4cc046)

diff --git a/filters/words/msword-odf/wv2/src/styles.cpp b/filters/words/msword-odf/wv2/src/styles.cpp
index c3132f0..0d691f5 100644
--- a/filters/words/msword-odf/wv2/src/styles.cpp
+++ b/filters/words/msword-odf/wv2/src/styles.cpp
@@ -248,6 +248,11 @@ throw(InvalidFormatException)
 #ifdef WV2_DEBUG_STYLESHEET
         wvlog << "cbUPX: " << cbUPX << endl;
 #endif
+        // do not overflow the allocated buffer grupx
+        if (offset + cbUPX > grupxLen) {
+            wvlog << "====> Error: grupx would overflow!" << endl;
+            return false;
+        }
         for ( U16 j = 0; j < cbUPX; ++j ) {
             grupx[ offset + j ] = stream->readU8();  // read the whole UPX
 #ifdef WV2_DEBUG_STYLESHEET
1	commit 7d72f7dd8d28d18c59a08a7d43bd4e0654043103
2	Author: Thorsten Zachmann <t.zachmann@zagge.de>
3	Date: Sat Aug 4 06:42:14 2012 +0200
4
5	Make sure not to write behind the allocated memory
6
7	Validate the input data to not write behind the allocated memory. This fixes a
8	buffer overflow found by Charlie Miller.
9	(cherry picked from commit 8652ab672eaaa145dfb3782f5011de58aa4cc046)
10
11	diff --git a/filters/words/msword-odf/wv2/src/styles.cpp b/filters/words/msword-odf/wv2/src/styles.cpp
12	index c3132f0..0d691f5 100644
13	--- a/filters/words/msword-odf/wv2/src/styles.cpp
14	+++ b/filters/words/msword-odf/wv2/src/styles.cpp
15	@@ -248,6 +248,11 @@ throw(InvalidFormatException)
16	#ifdef WV2_DEBUG_STYLESHEET
17	wvlog << "cbUPX: " << cbUPX << endl;
18	#endif
19	+ // do not overflow the allocated buffer grupx
20	+ if (offset + cbUPX > grupxLen) {
21	+ wvlog << "====> Error: grupx would overflow!" << endl;
22	+ return false;
23	+ }
24	for ( U16 j = 0; j < cbUPX; ++j ) {
25	grupx[ offset + j ] = stream->readU8(); // read the whole UPX
26	#ifdef WV2_DEBUG_STYLESHEET