ofz: infinite loop

Change-Id: I00eb3c1d97d27755c8b34676d2fa73a72fc8f9d7

1 files changed, 5 insertions, 1 deletions

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 1b2a8a8adda5..72efcfa7722c 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -926,7 +926,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                         ImplReadUnicodeComment( nUnicodeCommentStreamPos, rIStm, aStr );
                     rMtf.AddAction( new MetaTextAction( aPt, aStr, nIndex, nLen ) );
                 }
-                rIStm.Seek( nActBegin + nActionSize );
+
+                if (nActionSize < 24)
+                    rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+                else
+                    rIStm.Seek(nActBegin + nActionSize);
             }
             break;