security fixes in trunk

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

security fixes in trunk

Don Lewis-2
When I diff the files that were changed for security reasons in 4.1.4
(this is actually 4.1.5 since I have a fresh checkout handy) vs. the
same files in trunk, and throw out all the diff chunks that solely
contain whitespace, spelling, translation, etc. changes, this is what
remains:

--- aoo-trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx 2017-11-27 19:13:36.026633000 -0800
+++ aoo-4.1.5/main/comphelper/source/container/embeddedobjectcontainer.cxx 2017-11-27 15:33:19.130136000 -0800
@@ -127,7 +127,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = ::comphelper::OStorageHelper::GetTemporaryStorage();
     pImpl->mbOwnsStorage = true;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -136,7 +136,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -145,7 +145,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
     pImpl->m_xModel = xModel;
 }
--- aoo-trunk/main/sfx2/inc/sfx2/linkmgr.hxx 2017-11-27 19:13:35.993528000 -0800
+++ aoo-4.1.5/main/sfx2/inc/sfx2/linkmgr.hxx 2017-11-27 15:35:27.685685000 -0800
@@ -111,62 +112,59 @@
 
     SvLinkSourceRef CreateObj( SvBaseLink* );
 
+
+ // Automatically ask user about update all links, on first insert
+ void SetAutoAskUpdateAllLinks();
+
  void UpdateAllLinks( sal_Bool bAskUpdate = sal_True,
  sal_Bool bCallErrHdl = sal_True,
                                 sal_Bool bUpdateGrfLinks = sal_False,
                                 Window* pParentWin = 0 );
 
- // ask for the list of all links (e.g, for the link dialog)
+ // Liste aller Links erfragen (z.B. fuer Verknuepfungs-Dialog)
  const SvBaseLinks& GetLinks() const { return aLinkTbl; }
 
- // ----------------- Server-side Management --------------------
+ // ----------------- Serverseitige Verwaltung --------------------
 
- // ask for the list of all links that get served
+ // Liste der zu serviereden Links erfragen
  const SvLinkSources& GetServers() const { return aServerTbl; }
- // insert/delete a served link
+ // einen zu servierenden Link eintragen/loeschen
  sal_Bool InsertServer( SvLinkSource* rObj );
  void RemoveServer( SvLinkSource* rObj );
  void RemoveServer( sal_uInt16 nPos, sal_uInt16 nCnt = 1 )
  { aServerTbl.Remove( nPos, nCnt ); }
 
- // a transfer will be discontinued, therefore cancel all DownloadMedia
- // (at the moment only interesting for the FileLinks!)
-
+ // eine Uebertragung wird abgebrochen, also alle DownloadMedien canceln
+ // (ist zur Zeit nur fuer die FileLinks interressant!)
  void CancelTransfers();
 
- // to send status information from the FileObject to the BaseLink, there is an own ClipboardId.
- // The SvData object has then the respective information as string.
- // Currently this will be used for FileObject in connection with JavaScript
- // - that needs information about Load/Abort/Error
-
+ // um Status Informationen aus dem FileObject an den BaseLink zu
+ // senden, gibt es eine eigene ClipBoardId. Das SvData-Object hat
+ // dann die entsprechenden Informationen als String.
+ // Wird zur Zeit fuer FileObject in Verbindung mit JavaScript benoetigt
+ // - das braucht Informationen ueber Load/Abort/Error
  static sal_uIntPtr  RegisterStatusInfoId();
 
  // if the mimetype says graphic/bitmap/gdimetafile then get the
  // graphic from the Any. Return says no errors
  static sal_Bool GetGraphicFromAny( const String& rMimeType,
  const ::com::sun::star::uno::Any & rValue,
- Graphic& rGrf );
+ Graphic& rGrf );
 
- // Automatically ask user about update all links, on first insert
- void SetAutoAskUpdateAllLinks();
-
 private:
  LinkManager( const LinkManager& );
  LinkManager& operator=( const LinkManager& );
 };
 
-// separator in the LinkName for the DDE/File/Graphic links
-// (only who needs it, in order to assemble a SvLinkName)
+// Trenner im LinkName fuer die DDE-/File-/Grafik- Links
+// (nur wer es braucht, um einen SvLinkName zusammenzubasteln)
 const sal_Unicode cTokenSeperator = 0xFFFF;
 
 // erzeuge einen String fuer den SvLinkName. Fuer
 // - DDE die ersten 3 Strings, (Server, Topic, Item)
 // - File-/Grf-LinkNms die letzen 3 Strings (FileName, Bereich, Filter)
-// create a string for the SvLinkName. For:
-// - DDE the first 3 strings, (Server, Topic, Item)
-// - File/Graphic LinkNames the last 3 strings (FileName, Area, Filter)
 SFX2_DLLPUBLIC void MakeLnkName( String& rName,
- const String* pType, // can also be 0!
+ const String* pType, // kann auch 0 sein !!
  const String& rFile,
  const String& rLink,
  const String* pFilter = 0 );
--- aoo-trunk/main/sw/source/filter/ww8/ww8scan.cxx 2017-11-27 19:13:35.967600000 -0800
+++ aoo-4.1.5/main/sw/source/filter/ww8/ww8scan.cxx 2017-11-27 15:29:51.494284000 -0800
@@ -6467,6 +6467,12 @@
 
     if( nMax )
     {
+        // Check size consistency
+        if(nMax > nFFn)
+        {
+ throw std::out_of_range("WW8 beyond end of buffer");            
+        }
+
         // allocate Index Array
         pFontA = new WW8_FFN[ nMax ];
         p = pFontA;


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: security fixes in trunk

Patricia Shanahan
Thanks. I'll do a detailed analysis.

On 11/27/2017 7:44 PM, Don Lewis wrote:

> When I diff the files that were changed for security reasons in 4.1.4
> (this is actually 4.1.5 since I have a fresh checkout handy) vs. the
> same files in trunk, and throw out all the diff chunks that solely
> contain whitespace, spelling, translation, etc. changes, this is what
> remains:
>
> --- aoo-trunk/main/comphelper/source/container/embeddedobjectcontainer.cxx 2017-11-27 19:13:36.026633000 -0800
> +++ aoo-4.1.5/main/comphelper/source/container/embeddedobjectcontainer.cxx 2017-11-27 15:33:19.130136000 -0800
> @@ -127,7 +127,7 @@
>       pImpl = new EmbedImpl;
>       pImpl->mxStorage = ::comphelper::OStorageHelper::GetTemporaryStorage();
>       pImpl->mbOwnsStorage = true;
> -    pImpl->mbUserAllowsLinkUpdate = false;
> +    pImpl->mbUserAllowsLinkUpdate = true;
>       pImpl->mpTempObjectContainer = 0;
>   }
>  
> @@ -136,7 +136,7 @@
>       pImpl = new EmbedImpl;
>       pImpl->mxStorage = rStor;
>       pImpl->mbOwnsStorage = false;
> -    pImpl->mbUserAllowsLinkUpdate = false;
> +    pImpl->mbUserAllowsLinkUpdate = true;
>       pImpl->mpTempObjectContainer = 0;
>   }
>  
> @@ -145,7 +145,7 @@
>       pImpl = new EmbedImpl;
>       pImpl->mxStorage = rStor;
>       pImpl->mbOwnsStorage = false;
> -    pImpl->mbUserAllowsLinkUpdate = false;
> +    pImpl->mbUserAllowsLinkUpdate = true;
>       pImpl->mpTempObjectContainer = 0;
>       pImpl->m_xModel = xModel;
>   }
> --- aoo-trunk/main/sfx2/inc/sfx2/linkmgr.hxx 2017-11-27 19:13:35.993528000 -0800
> +++ aoo-4.1.5/main/sfx2/inc/sfx2/linkmgr.hxx 2017-11-27 15:35:27.685685000 -0800
> @@ -111,62 +112,59 @@
>  
>       SvLinkSourceRef CreateObj( SvBaseLink* );
>  
> +
> + // Automatically ask user about update all links, on first insert
> + void SetAutoAskUpdateAllLinks();
> +
>   void UpdateAllLinks( sal_Bool bAskUpdate = sal_True,
>   sal_Bool bCallErrHdl = sal_True,
>                                   sal_Bool bUpdateGrfLinks = sal_False,
>                                   Window* pParentWin = 0 );
>  
> - // ask for the list of all links (e.g, for the link dialog)
> + // Liste aller Links erfragen (z.B. fuer Verknuepfungs-Dialog)
>   const SvBaseLinks& GetLinks() const { return aLinkTbl; }
>  
> - // ----------------- Server-side Management --------------------
> + // ----------------- Serverseitige Verwaltung --------------------
>  
> - // ask for the list of all links that get served
> + // Liste der zu serviereden Links erfragen
>   const SvLinkSources& GetServers() const { return aServerTbl; }
> - // insert/delete a served link
> + // einen zu servierenden Link eintragen/loeschen
>   sal_Bool InsertServer( SvLinkSource* rObj );
>   void RemoveServer( SvLinkSource* rObj );
>   void RemoveServer( sal_uInt16 nPos, sal_uInt16 nCnt = 1 )
>   { aServerTbl.Remove( nPos, nCnt ); }
>  
> - // a transfer will be discontinued, therefore cancel all DownloadMedia
> - // (at the moment only interesting for the FileLinks!)
> -
> + // eine Uebertragung wird abgebrochen, also alle DownloadMedien canceln
> + // (ist zur Zeit nur fuer die FileLinks interressant!)
>   void CancelTransfers();
>  
> - // to send status information from the FileObject to the BaseLink, there is an own ClipboardId.
> - // The SvData object has then the respective information as string.
> - // Currently this will be used for FileObject in connection with JavaScript
> - // - that needs information about Load/Abort/Error
> -
> + // um Status Informationen aus dem FileObject an den BaseLink zu
> + // senden, gibt es eine eigene ClipBoardId. Das SvData-Object hat
> + // dann die entsprechenden Informationen als String.
> + // Wird zur Zeit fuer FileObject in Verbindung mit JavaScript benoetigt
> + // - das braucht Informationen ueber Load/Abort/Error
>   static sal_uIntPtr  RegisterStatusInfoId();
>  
>   // if the mimetype says graphic/bitmap/gdimetafile then get the
>   // graphic from the Any. Return says no errors
>   static sal_Bool GetGraphicFromAny( const String& rMimeType,
>   const ::com::sun::star::uno::Any & rValue,
> - Graphic& rGrf );
> + Graphic& rGrf );
>  
> - // Automatically ask user about update all links, on first insert
> - void SetAutoAskUpdateAllLinks();
> -
>   private:
>   LinkManager( const LinkManager& );
>   LinkManager& operator=( const LinkManager& );
>   };
>  
> -// separator in the LinkName for the DDE/File/Graphic links
> -// (only who needs it, in order to assemble a SvLinkName)
> +// Trenner im LinkName fuer die DDE-/File-/Grafik- Links
> +// (nur wer es braucht, um einen SvLinkName zusammenzubasteln)
>   const sal_Unicode cTokenSeperator = 0xFFFF;
>  
>   // erzeuge einen String fuer den SvLinkName. Fuer
>   // - DDE die ersten 3 Strings, (Server, Topic, Item)
>   // - File-/Grf-LinkNms die letzen 3 Strings (FileName, Bereich, Filter)
> -// create a string for the SvLinkName. For:
> -// - DDE the first 3 strings, (Server, Topic, Item)
> -// - File/Graphic LinkNames the last 3 strings (FileName, Area, Filter)
>   SFX2_DLLPUBLIC void MakeLnkName( String& rName,
> - const String* pType, // can also be 0!
> + const String* pType, // kann auch 0 sein !!
>   const String& rFile,
>   const String& rLink,
>   const String* pFilter = 0 );
> --- aoo-trunk/main/sw/source/filter/ww8/ww8scan.cxx 2017-11-27 19:13:35.967600000 -0800
> +++ aoo-4.1.5/main/sw/source/filter/ww8/ww8scan.cxx 2017-11-27 15:29:51.494284000 -0800
> @@ -6467,6 +6467,12 @@
>  
>       if( nMax )
>       {
> +        // Check size consistency
> +        if(nMax > nFFn)
> +        {
> + throw std::out_of_range("WW8 beyond end of buffer");
> +        }
> +
>           // allocate Index Array
>           pFontA = new WW8_FFN[ nMax ];
>           p = pFontA;
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>

---
This email has been checked for viruses by AVG.
http://www.avg.com


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: security fixes in trunk

Jim Jagielski
In reply to this post by Don Lewis-2
Thx!

Looking over, I does appear to me that these need to be committed to
trunk.

> On Nov 27, 2017, at 10:44 PM, Don Lewis <[hidden email]> wrote:
>
> When I diff the files that were changed for security reasons in 4.1.4
> (this is actually 4.1.5 since I have a fresh checkout handy) vs. the
> same files in trunk, and throw out all the diff chunks that solely
> contain whitespace, spelling, translation, etc. changes, this is what
> remains:
>


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: security fixes in trunk

Patricia Shanahan
The changes must not be committed as is, because that would undo some
comment translation. I have built a modified trunk and plan to test it
today. If all goes well I'll commit later today.

On 11/30/2017 7:38 AM, Jim Jagielski wrote:

> Thx!
>
> Looking over, I does appear to me that these need to be committed to
> trunk.
>
>> On Nov 27, 2017, at 10:44 PM, Don Lewis <[hidden email]> wrote:
>>
>> When I diff the files that were changed for security reasons in 4.1.4
>> (this is actually 4.1.5 since I have a fresh checkout handy) vs. the
>> same files in trunk, and throw out all the diff chunks that solely
>> contain whitespace, spelling, translation, etc. changes, this is what
>> remains:
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: security fixes in trunk

Jim Jagielski

> On Nov 30, 2017, at 11:07 AM, Patricia Shanahan <[hidden email]> wrote:
>
> The changes must not be committed as is, because that would undo some comment translation.

yes, of course.


---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]