From 9e77785b6fcf5aed2a51b7cbbe1ccd5f5e266851 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 16 Mar 2017 14:02:35 +0000
Subject: ofz#880 timeout loading svm

Change-Id: I8b19a66a7cb8d4eda3774ddc32a43e8653e1c6a0
---
 vcl/source/gdi/svmconverter.cxx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'vcl')

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 72efcfa7722c..55e1faf5b7c1 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -1034,7 +1034,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                         ImplReadUnicodeComment( nUnicodeCommentStreamPos, rIStm, aStr );
                     rMtf.AddAction( new MetaStretchTextAction( aPt, nWidth, aStr, nIndex, nLen ) );
                 }
-                rIStm.Seek( nActBegin + nActionSize );
+
+                if (nActionSize < 28)
+                    rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+                else
+                    rIStm.Seek(nActBegin + nActionSize);
             }
             break;
 
-- 
cgit