From cff6cdb2ee37e836b9bab39500d24fcedc360121 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 9 Feb 2017 09:21:39 +0000
Subject: Resolves: ofz#576 unexpected exception with invalid fraction

Change-Id: I1d653775e88e9fa2ba7b62fce39d52fc21ffe363
---
 vcl/source/gdi/svmconverter.cxx | 48 +++++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 19 deletions(-)

(limited to 'vcl')

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 9d963f457dc2..06c532509ef5 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -129,19 +129,26 @@ void ImplWriteColor( SvStream& rOStm, const Color& rColor )
     rOStm.WriteInt16( nVal );
 }
 
-void ImplReadMapMode( SvStream& rIStm, MapMode& rMapMode )
+bool ImplReadMapMode(SvStream& rIStm, MapMode& rMapMode)
 {
-    Point   aOrg;
-    sal_Int32   nXNum;
-    sal_Int32   nXDenom;
-    sal_Int32   nYNum;
-    sal_Int32   nYDenom;
-    sal_Int16   nUnit;
-
-    rIStm.ReadInt16( nUnit );
-    ReadPair( rIStm, aOrg );
-    rIStm.ReadInt32( nXNum ).ReadInt32( nXDenom ).ReadInt32( nYNum ).ReadInt32( nYDenom );
+    sal_Int16 nUnit(0);
+    rIStm.ReadInt16(nUnit);
+
+    Point aOrg;
+    ReadPair(rIStm, aOrg);
+
+    sal_Int32 nXNum(0), nXDenom(0), nYNum(0), nYDenom(0);
+    rIStm.ReadInt32(nXNum).ReadInt32(nXDenom).ReadInt32(nYNum).ReadInt32(nYDenom);
+
+    if (!rIStm.good() || nXDenom == 0 || nYDenom == 0)
+    {
+        SAL_WARN("vcl.gdi", "Parsing error: invalid mapmode fraction");
+        return false;
+    }
+
     rMapMode = MapMode( (MapUnit) nUnit, aOrg, Fraction( nXNum, nXDenom ), Fraction( nYNum, nYDenom ) );
+
+    return true;
 }
 
 void ImplWriteMapMode( SvStream& rOStm, const MapMode& rMapMode )
@@ -503,7 +510,6 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
     rtl_TextEncoding    eActualCharSet = osl_getThreadTextEncoding();
     bool                bFatLine = false;
 
-    MapMode     aMapMode;
     tools::Polygon     aActionPoly;
     Rectangle   aRect;
     Point       aPt, aPt1;
@@ -513,7 +519,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
     sal_uInt32  nUnicodeCommentStreamPos = 0;
     sal_Int32       nUnicodeCommentActionNumber = 0;
 
-    ImplReadMapMode( rIStm, aMapMode );             // MapMode
+    rMtf.SetPrefSize(aPrefSz);
+
+    MapMode aMapMode;
+    if (ImplReadMapMode(rIStm, aMapMode))           // MapMode
+        rMtf.SetPrefMapMode(aMapMode);
 
     sal_Int32 nActions(0);
     rIStm.ReadInt32(nActions);                      // Action count
@@ -531,8 +541,6 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
         nActions = nMaxPossibleActions;
     }
 
-    rMtf.SetPrefSize( aPrefSz );
-    rMtf.SetPrefMapMode( aMapMode );
     size_t nLastPolygonAction(0);
 
     for (sal_Int32 i = 0; i < nActions && rIStm.good(); ++i)
@@ -1042,11 +1050,13 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
             case GDI_MAPMODE_ACTION:
             {
-                ImplReadMapMode( rIStm, aMapMode );
-                rMtf.AddAction( new MetaMapModeAction( aMapMode ) );
+                if (ImplReadMapMode(rIStm, aMapMode))
+                {
+                    rMtf.AddAction(new MetaMapModeAction(aMapMode));
 
-                // #106172# Track font relevant data in shadow VDev
-                aFontVDev->SetMapMode( aMapMode );
+                    // #106172# Track font relevant data in shadow VDev
+                    aFontVDev->SetMapMode(aMapMode);
+                };
             }
             break;
 
-- 
cgit