2 files changed, 12 insertions, 0 deletions
diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index 35a5f020d0fa..252015bab2e6 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -2088,6 +2088,12 @@ namespace emfio
         mpInputStream->ReadInt32(nBottom);
 
         SAL_INFO("emfio", "\t\tLeft: " << nLeft << ", top: " << nTop << ", right: " << nRight << ", bottom: " << nBottom);
+        if (nLeft > nRight || nTop > nBottom)
+        {
+            SAL_WARN("emfio", "broken rectangle");
+            mpInputStream->SetError( SVSTREAM_FILEFORMAT_ERROR );
+            return tools::Rectangle();
+        }
 
         return tools::Rectangle(nLeft, nTop, nRight, nBottom);
     }
diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx
index 1d67f5c52e98..3f8af75bbd50 100644
--- a/emfio/source/reader/wmfreader.cxx
+++ b/emfio/source/reader/wmfreader.cxx
@@ -165,6 +165,12 @@ namespace emfio
         aTL = ReadYX();
         aBR.AdjustX( -1 );
         aBR.AdjustY( -1 );
+        if (aTL.X() > aBR.X() || aTL.Y() > aBR.Y())
+        {
+            SAL_WARN("vcl.wmf", "broken rectangle");
+            mpInputStream->SetError( SVSTREAM_FILEFORMAT_ERROR );
+            return tools::Rectangle();
+        }
         return tools::Rectangle( aTL, aBR );
     }