diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-03-10 09:07:08 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-03-10 12:14:26 +0100 |
| commit | 317779e86a8cc4d1e2e3c7e227b732407bbadf26 (patch) | |
| tree | a5f46e605ce5ec01c56ab762b59a6e1afa9dd6c8 /vcl | |
| parent | 84213a426ad10e85075ef159da28b4e56dabcb77 (diff) | |
ofz#45375 Timeout on negative width/height for MetaBmpExScaleAction
Change-Id: I9c8ce8715cb683ac72f862606b6810fe4f1fe2d2
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131305
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/svm/SvmReader.cxx | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/vcl/source/filter/svm/SvmReader.cxx b/vcl/source/filter/svm/SvmReader.cxx index cdc731528ffb..550e9e59bcfd 100644 --- a/vcl/source/filter/svm/SvmReader.cxx +++ b/vcl/source/filter/svm/SvmReader.cxx @@ -899,8 +899,20 @@ rtl::Reference<MetaAction> SvmReader::BmpExScaleHandler() TypeSerializer aSerializer(mrStream); Point aPoint; aSerializer.readPoint(aPoint); + Size aSize; aSerializer.readSize(aSize); + if (aSize.Width() < 0) + { + SAL_WARN("vcl.gdi", "MetaBmpExScaleAction: negative width"); + aSize.setWidth(0); + } + + if (aSize.Height() < 0) + { + SAL_WARN("vcl.gdi", "MetaBmpExScaleAction: negative height"); + aSize.setHeight(0); + } pAction->SetBitmapEx(aBmpEx); pAction->SetPoint(aPoint); |