ofz: further limit exttextout to record size is smaller than stream size

Change-Id: I5f59db9e0c32f601537860d7574044b713d1c39d
Reviewed-on: https://gerrit.libreoffice.org/44696
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx
index b27b49e307f7..97861c225306 100644
--- a/emfio/source/reader/wmfreader.cxx
+++ b/emfio/source/reader/wmfreader.cxx
@@ -553,7 +553,8 @@ namespace emfio
                         aRect = tools::Rectangle( aPt1, aPt2 );
                     }
 
-                    auto nRemainingSize = mpInputStream->remainingSize();
+                    auto nMaxStreamPos = nRecordPos + (nRecordSize << 1);
+                    auto nRemainingSize = std::min(mpInputStream->remainingSize(), nMaxStreamPos - mpInputStream->Tell());
                     if (nRemainingSize < static_cast<sal_uInt32>(nOriginalBlockLen))
                     {
                         SAL_WARN("vcl.wmf", "exttextout record claimed more data than the stream can provide");
@@ -568,7 +569,6 @@ namespace emfio
                     if ( nNewTextLen )
                     {
                         std::unique_ptr<long[]> pDXAry, pDYAry;
-                        auto nMaxStreamPos = nRecordPos + ( nRecordSize << 1 );
                         auto nDxArySize =  nMaxStreamPos - mpInputStream->Tell();
                         auto nDxAryEntries = nDxArySize >> 1;
                         bool        bUseDXAry = false;