svmconverter value < 0 seem wrong for width and height (vcl/gdi)

Change-Id: I39e639e2e14d4c377f2e8f3a74869622d0611bd9
Reviewed-on: https://gerrit.libreoffice.org/62977
Tested-by: Jenkins
Reviewed-by: Julien Nabet <serval2412@yahoo.fr>

1 files changed, 21 insertions, 3 deletions

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index b00fdfdce81b..1a689ce1dfcd 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -243,6 +243,13 @@ namespace
 
 #define LF_FACESIZE 32
 
+void static lcl_error( SvStream& rIStm, const SvStreamEndian& nOldFormat, const sal_uLong& nPos)
+{
+    rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+    rIStm.SetEndian(nOldFormat);
+    rIStm.Seek(nPos);
+    return;
+}
 void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 {
     const sal_uLong         nPos = rIStm.Tell();
@@ -261,8 +268,20 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
     rIStm.ReadInt16( nVersion );                              // Version
     sal_Int32 nTmp32(0);
     rIStm.ReadInt32( nTmp32 );
+    if (nTmp32 < 0)
+    {
+        SAL_WARN("vcl.gdi", "svm: value for width should be positive");
+        lcl_error(rIStm, nOldFormat, nPos);
+        return;
+    }
     aPrefSz.setWidth( nTmp32 );                       // PrefSize.Width()
     rIStm.ReadInt32( nTmp32 );
+    if (nTmp32 < 0)
+    {
+        SAL_WARN("vcl.gdi", "svm: value for height should be positive");
+        lcl_error(rIStm, nOldFormat, nPos);
+        return;
+    }
     aPrefSz.setHeight( nTmp32 );                      // PrefSize.Height()
 
     // check header-magic and version
@@ -270,9 +289,8 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
         || ( memcmp( aCode, "SVGDI", sizeof( aCode ) ) != 0 )
         || ( nVersion != 200 ) )
     {
-        rIStm.SetError( SVSTREAM_FILEFORMAT_ERROR );
-        rIStm.SetEndian( nOldFormat );
-        rIStm.Seek( nPos );
+        SAL_WARN("vcl.gdi", "svm: wrong check for header-magic and version");
+        lcl_error(rIStm, nOldFormat, nPos);
         return;
     }