diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2013-11-12 14:56:43 +0000 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2013-11-13 15:57:54 +0000 |
| commit | 071b6681564242d418d086e5991e1dbacc3b897c (patch) | |
| tree | 302a3c082671573afaf73913882aa110c554cfb1 | |
| parent | 393c38129284fe3b9b9fc0b927f8cd128f016a86 (diff) | |
Resolves: fdo#71307 out polygons are limited to 16bit point count
Change-Id: I4dbe9145466d6d93ebd3dea7f4fe434c9ee3de19
(cherry picked from commit cdd351b1487a8a97f481a9165d9cd361aaee2ca4)
Reviewed-on: https://gerrit.libreoffice.org/6655
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf | bin | 0 -> 24229 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 5 |
2 files changed, 5 insertions, 0 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf Binary files differnew file mode 100644 index 000000000000..b89db21c2d0a --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index ad2a3a6d0d33..de8b7801e184 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -344,6 +344,11 @@ void EnhWMFReader::ReadAndDrawPolygon(Drawer drawer, const sal_Bool skipFirst) template <class T> Polygon EnhWMFReader::ReadPolygon(sal_uInt32 nStartIndex, sal_uInt32 nPoints) { + bool bRecordOk = nPoints <= SAL_MAX_UINT16; + SAL_WARN_IF(!bRecordOk, "svtools.filter", "polygon record has more polygons than we can handle"); + if (!bRecordOk) + return Polygon(); + Polygon aPolygon(nPoints); for (sal_uInt16 i = nStartIndex ; i < nPoints && pWMF->good(); i++ ) { |