diff options
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf | bin | 0 -> 375 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 7 |
2 files changed, 4 insertions, 3 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf Binary files differnew file mode 100644 index 000000000000..f8f153896c7c --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index ac4caa0ada1b..1ea6e213551d 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -637,14 +637,15 @@ bool EnhWMFReader::ReadEnhWMF() break; } - nNextPos = pWMF->Tell() + ( nRecSize - 8 ); - - if ( !pWMF->good() || nNextPos > nEndPos ) + const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF->Tell() + 8; + if (nRecSize > nMaxPossibleRecSize) { bStatus = false; break; } + nNextPos = pWMF->Tell() + ( nRecSize - 8 ); + if( !aBmpSaveList.empty() && ( nRecType != EMR_STRETCHBLT ) && ( nRecType != EMR_STRETCHDIBITS ) |