diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-12 16:30:21 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-08-12 17:00:57 +0100 |
| commit | 7ffe6aebb44ed3f7b5fd1ffe3ccfccf0f61984b3 (patch) | |
| tree | d7d7333d0ad8f5bea6c48b5ebc685df1c50ef4cf /vcl | |
| parent | f5ace6b29e794aa9658da0fde4ed766d2b521cb2 (diff) | |
another avoid endless loop with busted wmf
Change-Id: Ie4068fdc1e54e0ad3e55354938a4c5e1459e7fe0
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf | bin | 0 -> 375 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 7 |
2 files changed, 4 insertions, 3 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf Binary files differnew file mode 100644 index 000000000000..f8f153896c7c --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index ac4caa0ada1b..1ea6e213551d 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -637,14 +637,15 @@ bool EnhWMFReader::ReadEnhWMF() break; } - nNextPos = pWMF->Tell() + ( nRecSize - 8 ); - - if ( !pWMF->good() || nNextPos > nEndPos ) + const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF->Tell() + 8; + if (nRecSize > nMaxPossibleRecSize) { bStatus = false; break; } + nNextPos = pWMF->Tell() + ( nRecSize - 8 ); + if( !aBmpSaveList.empty() && ( nRecType != EMR_STRETCHBLT ) && ( nRecType != EMR_STRETCHDIBITS ) |