From b5344daa0cfc31cf187832261651e5490b19d922 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 13 Nov 2017 21:06:57 +0000 Subject: ofz: further limit exttextout to record size is smaller than stream size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I5f59db9e0c32f601537860d7574044b713d1c39d Reviewed-on: https://gerrit.libreoffice.org/44696 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- emfio/source/reader/wmfreader.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index b27b49e307f7..97861c225306 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -553,7 +553,8 @@ namespace emfio aRect = tools::Rectangle( aPt1, aPt2 ); } - auto nRemainingSize = mpInputStream->remainingSize(); + auto nMaxStreamPos = nRecordPos + (nRecordSize << 1); + auto nRemainingSize = std::min(mpInputStream->remainingSize(), nMaxStreamPos - mpInputStream->Tell()); if (nRemainingSize < static_cast(nOriginalBlockLen)) { SAL_WARN("vcl.wmf", "exttextout record claimed more data than the stream can provide"); @@ -568,7 +569,6 @@ namespace emfio if ( nNewTextLen ) { std::unique_ptr pDXAry, pDYAry; - auto nMaxStreamPos = nRecordPos + ( nRecordSize << 1 ); auto nDxArySize = nMaxStreamPos - mpInputStream->Tell(); auto nDxAryEntries = nDxArySize >> 1; bool bUseDXAry = false; -- cgit