diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2013-11-12 14:56:43 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2013-11-17 20:47:24 +0100 |
| commit | 3b44cb0715a44684fcb8139954e5d76a1072a487 (patch) | |
| tree | 9c51aa3d1caa8a0b98edb6d319230bb1e21b546a | |
| parent | 4025c22d2d0c11dfe8051f176376f3336b24a26a (diff) | |
Resolves: fdo#71307 out polygons are limited to 16bit point count
Change-Id: I4dbe9145466d6d93ebd3dea7f4fe434c9ee3de19
(cherry picked from commit cdd351b1487a8a97f481a9165d9cd361aaee2ca4)
Reviewed-on: https://gerrit.libreoffice.org/6655
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf | bin | 0 -> 24229 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 5 |
2 files changed, 5 insertions, 0 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf Binary files differnew file mode 100644 index 000000000000..b89db21c2d0a --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index f8b98845be4e..b74b99295fe9 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -330,6 +330,11 @@ void EnhWMFReader::ReadAndDrawPolygon(Drawer drawer, const sal_Bool skipFirst) template <class T> Polygon EnhWMFReader::ReadPolygon(sal_uInt32 nStartIndex, sal_uInt32 nPoints) { + bool bRecordOk = nPoints <= SAL_MAX_UINT16; + SAL_WARN_IF(!bRecordOk, "svtools.filter", "polygon record has more polygons than we can handle"); + if (!bRecordOk) + return Polygon(); + Polygon aPolygon(nPoints); for (sal_uInt16 i = nStartIndex ; i < nPoints && pWMF->good(); i++ ) { |