ofz#2538 avoid oom

Change-Id: Ief86805a1d8c010826351d7b701678ee2945770d
Reviewed-on: https://gerrit.libreoffice.org/42466
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

2 files changed, 16 insertions, 12 deletions

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 62b43b4ea6a6..ac04412ca3f4 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5874,19 +5874,23 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
     sal_uLong nLenBStoreCont = 0, nLenFBSE = 0, nRead = 0;
 
     // search for a  BStore Container
+    bool bOk = true;
     do
     {
-        if(!ReadCommonRecordHeader( rSt, nVer, nInst, nFbt, nLength)) return;
+        if (!ReadCommonRecordHeader(rSt, nVer, nInst, nFbt, nLength))
+            return;
         nRead += DFF_COMMON_RECORD_HEADER_SIZE + nLength;
-        if( DFF_msofbtBstoreContainer == nFbt )
+        if (DFF_msofbtBstoreContainer == nFbt)
         {
-            nLenBStoreCont = nLength;       break;
+            nLenBStoreCont = nLength;
+            break;
         }
-        rSt.SeekRel( nLength );
+        bOk = checkSeek(rSt, rSt.Tell() + nLength);
     }
-    while( nRead < nLenDgg );
+    while (bOk && nRead < nLenDgg);
 
-    if( !nLenBStoreCont ) return;
+    if (!bOk || !nLenBStoreCont)
+        return;
 
     // Read all atoms of the containers from the BStore container and store all
     // relevant data of all contained FBSEs in out pointer array.
@@ -5906,9 +5910,9 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
         {
             nLenFBSE = nLength;
             // is FBSE big enough for our data
-            bool bOk = ( nSkipBLIPLen + 4 + nSkipBLIPPos + 4 <= nLenFBSE );
+            bOk = ( nSkipBLIPLen + 4 + nSkipBLIPPos + 4 <= nLenFBSE );
 
-            if( bOk )
+            if (bOk)
             {
                 rSt.SeekRel( nSkipBLIPLen );
                 rSt.ReadUInt32( nBLIPLen );
@@ -5919,7 +5923,7 @@ void SvxMSDffManager::GetDrawingGroupContainerData( SvStream& rSt, sal_uLong nLe
                 nLength -= nSkipBLIPLen+ 4 + nSkipBLIPPos + 4;
             }
 
-            if( bOk )
+            if (bOk)
             {
                 // specialty:
                 // If nBLIPLen is less than nLenFBSE AND nBLIPPos is NULL,
diff --git a/include/filter/msfilter/dffrecordheader.hxx b/include/filter/msfilter/dffrecordheader.hxx
index 3ad5c4837055..acd0d2539889 100644
--- a/include/filter/msfilter/dffrecordheader.hxx
+++ b/include/filter/msfilter/dffrecordheader.hxx
@@ -45,16 +45,16 @@ public:
     bool SeekToEndOfRecord(SvStream& rIn) const
     {
         sal_uInt64 const nPos = nFilePos + DFF_COMMON_RECORD_HEADER_SIZE + nRecLen;
-        return nPos == rIn.Seek(nPos);
+        return checkSeek(rIn, nPos);
     }
     bool SeekToContent(SvStream& rIn) const
     {
         sal_uInt64 const nPos = nFilePos + DFF_COMMON_RECORD_HEADER_SIZE;
-        return nPos == rIn.Seek(nPos);
+        return checkSeek(rIn, nPos);
     }
     bool SeekToBegOfRecord(SvStream& rIn) const
     {
-        return nFilePos == rIn.Seek(nFilePos);
+        return checkSeek(rIn, nFilePos);
     }
 
     MSFILTER_DLLPUBLIC friend bool ReadDffRecordHeader(SvStream& rIn, DffRecordHeader& rRec);