avoid endless loop with busted wmf

Change-Id: I104de360f2e861e959ad2dad434a768440877f6f

2 files changed, 7 insertions, 3 deletions

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf
new file mode 100644
index 000000000000..7ba05cb00219
--- /dev/null
+++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 343b74f54a15..7b87f68a0013 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1394,9 +1394,13 @@ void WMFReader::ReadWMF()
                         }
                     }
                 }
-                nPos += nRecSize * 2;
-                if ( nPos <= nEndPos )
-                    pWMF->Seek( nPos  );
+                const sal_uInt32 nAvailableBytes = nEndPos - nPos;
+                const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+                if (nRecSize <= nMaxPossibleRecordSize)
+                {
+                    nPos += nRecSize * 2;
+                    pWMF->Seek(nPos);
+                }
                 else
                     pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
             }