diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-15 16:32:43 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-15 16:34:39 +0000 |
| commit | 68598e06bc5a5fefb917f436d44bec1623d0fbeb (patch) | |
| tree | aa31cf0417357b3c333bc6e214c6c6d31a32fe05 /vcl/source/gdi | |
| parent | 8d18a78e91778db61db280f596011bfe0a80d570 (diff) | |
ofz: infinite loop
Change-Id: I00eb3c1d97d27755c8b34676d2fa73a72fc8f9d7
Diffstat (limited to 'vcl/source/gdi')
| -rw-r--r-- | vcl/source/gdi/svmconverter.cxx | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx index 1b2a8a8adda5..72efcfa7722c 100644 --- a/vcl/source/gdi/svmconverter.cxx +++ b/vcl/source/gdi/svmconverter.cxx @@ -926,7 +926,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf ) ImplReadUnicodeComment( nUnicodeCommentStreamPos, rIStm, aStr ); rMtf.AddAction( new MetaTextAction( aPt, aStr, nIndex, nLen ) ); } - rIStm.Seek( nActBegin + nActionSize ); + + if (nActionSize < 24) + rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR); + else + rIStm.Seek(nActBegin + nActionSize); } break; |