diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2016-12-10 20:51:58 +0000 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2016-12-13 07:25:02 +0000 |
| commit | 28ed3227267f7a00273595a60206744fd3c78b96 (patch) | |
| tree | 1e9f00e1b05e9efd778f7981a67ac3fe6ce876e2 /vcl | |
| parent | 2670760550608c3f51bb01eb7b86c33461e2e5c8 (diff) | |
oss-fuzz: handle W_META_CREATEFONTINDIRECT like EMR_EXTCREATEFONTINDIRECTW
Change-Id: Iaa142d5d0ac0f00e89e8b7d7ffdef8137157cec9
(cherry picked from commit e718ac0ae415bba2988c96c36995755bbfd9df7f)
(cherry picked from commit d3ea20e55ca7d82b6121f7ed3db5fd170fcac94f)
Reviewed-on: https://gerrit.libreoffice.org/31839
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf | bin | 0 -> 4197 bytes | |||
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf | bin | 0 -> 5082 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 3 |
3 files changed, 2 insertions, 1 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf Binary files differnew file mode 100644 index 000000000000..29c534fdcc65 --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf Binary files differnew file mode 100644 index 000000000000..e2fac15234e1 --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 1c65342c53c1..c4f7e7889666 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -885,7 +885,8 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc ) case W_META_CREATEFONTINDIRECT: { Size aFontSize; - char lfFaceName[LF_FACESIZE]; + char lfFaceName[LF_FACESIZE+1]; + lfFaceName[LF_FACESIZE] = 0; sal_Int16 lfEscapement = 0; sal_Int16 lfOrientation = 0; sal_Int16 lfWeight = 0; |