diff options
Diffstat (limited to 'vcl/source/gdi/svmconverter.cxx')
| -rw-r--r-- | vcl/source/gdi/svmconverter.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx index 616e5e79918e..d9aae46824f0 100644 --- a/vcl/source/gdi/svmconverter.cxx +++ b/vcl/source/gdi/svmconverter.cxx @@ -909,6 +909,15 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf ) sal_Int32 nDXAryLen = 0; if (nAryLen > 0) { + const size_t nMinRecordSize = sizeof(sal_Int32); + const size_t nMaxRecords = rIStm.remainingSize() / nMinRecordSize; + if (static_cast<sal_uInt32>(nAryLen) > nMaxRecords) + { + SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nAryLen << " claimed, truncating"); + nAryLen = nMaxRecords; + } + sal_Int32 nStrLen( aStr.getLength() ); nDXAryLen = std::max(nAryLen, nStrLen); |