From 15dfcb7f461893f83abcf28bfe01a4164209a160 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 15 Jul 2015 12:18:10 +0100 Subject: don't hang with 0 len causing no progression Change-Id: Ie553dab291c7bfbde033d89b84159aff6b42a160 --- filter/qa/cppunit/data/met/fail/hang-1.met | Bin 0 -> 600 bytes filter/source/graphicfilter/ios2met/ios2met.cxx | 12 +++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) create mode 100644 filter/qa/cppunit/data/met/fail/hang-1.met diff --git a/filter/qa/cppunit/data/met/fail/hang-1.met b/filter/qa/cppunit/data/met/fail/hang-1.met new file mode 100644 index 000000000000..c1a095d3fad5 Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/hang-1.met differ diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index f1b99812f092..f152963d253b 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -2239,7 +2239,6 @@ void OS2METReader::ReadImageData(sal_uInt16 nDataID, sal_uInt16 nDataLen) void OS2METReader::ReadFont(sal_uInt16 nFieldSize) { sal_uLong nPos, nMaxPos; - sal_uInt16 nLen; sal_uInt8 nByte, nTripType, nTripType2; OSFont * pF=new OSFont; pF->pSucc=pFontList; pFontList=pF; @@ -2251,7 +2250,13 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize) nMaxPos=nPos+(sal_uLong)nFieldSize; pOS2MET->SeekRel(2); nPos+=2; while (nPosGetError()==0) { - pOS2MET->ReadUChar( nByte ); nLen =((sal_uInt16)nByte) & 0x00ff; + pOS2MET->ReadUChar( nByte ); + sal_uInt16 nLen = ((sal_uInt16)nByte) & 0x00ff; + if (nLen == 0) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=4; + } pOS2MET->ReadUChar( nTripType ); switch (nTripType) { case 0x02: @@ -2303,7 +2308,8 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize) break; } } - nPos+=nLen; pOS2MET->Seek(nPos); + nPos+=nLen; + pOS2MET->Seek(nPos); } } -- cgit