ofz: timeout, check availablity of point data before reading it

Change-Id: I86b3041bc5123ba10bbb9b64702dfb2060b3cc23

1 files changed, 6 insertions, 0 deletions

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 4003b0fd49c7..a85e691f7b64 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -461,6 +461,12 @@ sal_uLong PictReader::ReadPolygon(tools::Polygon & rPoly)
     pPict->SeekRel(8);
     sal_uLong nDataSize = (sal_uLong)nSize;
     nSize=(nSize-10)/4;
+    const size_t nMaxPossiblePoints = pPict->remainingSize() / 2 * sizeof(sal_uInt16);
+    if (nSize > nMaxPossiblePoints)
+    {
+        SAL_WARN("filter.pict", "pict record claims to have: " << nSize << " points, but only " << nMaxPossiblePoints << " possible, clamping");
+        nSize = nMaxPossiblePoints;
+    }
     rPoly.SetSize(nSize);
     for (sal_uInt16 i = 0; i < nSize; ++i)
         rPoly.SetPoint(ReadPoint(), i);