| 2d2c30bc | 18-Sep-2026 |
Peter <petko@apache.org> |
filter: idxf: port the input-validation hunks missed by the #491 backport
PR #491 was landed on AOO41X as 3c5a7184f8 ("cherry pick and adaptation
of merge commit c082241a9b"), but three hardening hu
filter: idxf: port the input-validation hunks missed by the #491 backport
PR #491 was landed on AOO41X as 3c5a7184f8 ("cherry pick and adaptation
of merge commit c082241a9b"), but three hardening hunks of the series did
not survive the adaptation:
* DXFBoundaryPathData::EvaluateGroup, group 93: the vertex count taken
from the file was used for `new DXFVector[n]` without checking the
reader status or the sign. A negative or unread count reached
operator new[]; a huge one threw std::bad_alloc out of the filter.
Check GetStatus() and n >= 0, and turn bad_alloc into a reader error.
* DXFHatchEntity::EvaluateGroup, group 91: identical problem for the
boundary-path count driving `new DXFBoundaryPathData[n]`.
* DXFGroupReader::ReadI: the hand-rolled do/while accumulated digits
without any overflow or termination check, so it also ran once on a
non-digit before testing. Parse with strtol over the digit run and
reject the group unless the converted span ends exactly where the
scan did.
Both allocation sites are reachable from HATCH entities in an untrusted
DXF, which is what makes these worth carrying over rather than leaving to
the next full sync.
Also fixes the "assoiciative" comment typo on nAssociativityFlag, so the
file matches trunk.
No functional change beyond the above: after this commit the idxf sources
on AOO41X are content-identical to the #491 head (96b0524be2), modulo the
trailing-whitespace cleanup trunk applied to the licence headers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
show more ...
|