解决一处潜在的崩溃问题

This commit is contained in:
iaom 2023-04-28 16:51:51 +08:00
parent 35818d321e
commit f5eaf99f6f
1 changed files with 12 additions and 3 deletions

View File

@ -4562,19 +4562,26 @@ static void vName2String(char *szName, const UCHAR *aucBytes, size_t tNameSize)
} /* end of vName2String */
void vAdd2PropModList(const UCHAR *aucPropMod) {
bool vAdd2PropModList(const UCHAR *aucPropMod) {
size_t tSize, tLen;
if(tNextFree >= tMaxElements) {
tMaxElements += ELEMENTS_TO_ADD;
tSize = tMaxElements * sizeof(UCHAR **);
ppAnchor = (UCHAR**)xrealloc(ppAnchor, tSize);
void *pvTmp;
pvTmp = realloc(ppAnchor, tSize);
if(pvTmp) {
ppAnchor = (UCHAR**)pvTmp;
} else {
return false;
}
}
tLen = 2 + (size_t)usGetWord(0, aucPropMod);
ppAnchor[tNextFree] = (UCHAR*)xmalloc(tLen);
memcpy(ppAnchor[tNextFree], aucPropMod, tLen);
tNextFree++;
return true;
} /* end of vAdd2PropModList */
static void vComputePPSlevels(ppsEntryType *atPPSlist, ppsEntryType *pNode,
@ -4940,7 +4947,9 @@ bool KBinaryParser::read8DocText(FILE *pFile, const ppsInfoType *pPPS,
}
if(iType == 1) {
iLen = (int)usGetWord(lOff, aucBuffer);
vAdd2PropModList(aucBuffer + lOff);
if(!vAdd2PropModList(aucBuffer + lOff)) {
return false;
}
lOff += (long)iLen + 2;
continue;
}