diff options
| author | Mike Kaganski <mike.kaganski@collabora.com> | 2015-08-29 00:57:20 +1000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-09-28 10:18:42 +0200 |
| commit | 1f05e16a2cbeac406deb042249b2a7ca3d154c82 (patch) | |
| tree | fe79c382faff329fec0ad965bf52509523cca2bd /vcl | |
| parent | 0cd78fa1f553d5d01ca9f28fb04213ed9b126397 (diff) | |
bnc#930818: allow for EMF+ record padding up to 11 bytes
When an array of EMF+ has extra bytes in the end, that are less than 12,
they should not be treated as another EMF+ record, but simply ignored.
Conflicts:
cppcanvas/source/mtfrenderer/emfplus.cxx
Change-Id: I34701c00916812c8a6a4b69730f602da81719b35
(cherry picked from commit a427022a74163ad8711c66ddd848211e87b05197)
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index 4d1098968fcf..e89a95151604 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -295,10 +295,8 @@ void EnhWMFReader::ReadEMFPlusComment(sal_uInt32 length, bool& bHaveDC) bHaveDC = false; - OSL_ASSERT(length >= 4); - // reduce by 32bit length itself, skip in SeekRel if - // impossibly unavailable - sal_uInt32 nRemainder = length >= 4 ? length-4 : length; + // skip in SeekRel if impossibly unavailable + sal_uInt32 nRemainder = length; const size_t nRequiredHeaderSize = 12; while (nRemainder >= nRequiredHeaderSize) @@ -534,7 +532,9 @@ bool EnhWMFReader::ReadEnhWMF() // EMF+ comment (FIXME: BE?) if( id == 0x2B464D45 && nRecSize >= 12 ) - ReadEMFPlusComment( length, bHaveDC ); + // [MS-EMF] 2.3.3: DataSize includes both CommentIdentifier and CommentRecordParm fields. + // We have already read 4-byte CommentIdentifier, so reduce length appropriately + ReadEMFPlusComment( length-4, bHaveDC ); // GDIC comment, doesn't do anything useful yet else if( id == 0x43494447 && nRecSize >= 12 ) { // TODO: ReadGDIComment() |