summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2013-11-12 14:56:43 +0000
committerAndras Timar <andras.timar@collabora.com>2013-11-18 06:50:39 -0800
commitab7dd0fdbf1f3e26b64caf6c413c9c907633d29e (patch)
treef918b7f63d88166d9aaa6d3a1b2341de078a58a0
parent884070670824a210832739c9235693cd3fd6cca8 (diff)
Resolves: fdo#71307 out polygons are limited to 16bit point count
Change-Id: I4dbe9145466d6d93ebd3dea7f4fe434c9ee3de19 (cherry picked from commit cdd351b1487a8a97f481a9165d9cd361aaee2ca4) Reviewed-on: https://gerrit.libreoffice.org/6655 Reviewed-by: David Tardon <dtardon@redhat.com> Tested-by: David Tardon <dtardon@redhat.com>
-rw-r--r--vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emfbin0 -> 24229 bytes
-rw-r--r--vcl/source/filter/wmf/enhwmf.cxx5
2 files changed, 5 insertions, 0 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf
new file mode 100644
index 000000000000..b89db21c2d0a
--- /dev/null
+++ b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf
Binary files differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index f8b98845be4e..b74b99295fe9 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -330,6 +330,11 @@ void EnhWMFReader::ReadAndDrawPolygon(Drawer drawer, const sal_Bool skipFirst)
template <class T>
Polygon EnhWMFReader::ReadPolygon(sal_uInt32 nStartIndex, sal_uInt32 nPoints)
{
+ bool bRecordOk = nPoints <= SAL_MAX_UINT16;
+ SAL_WARN_IF(!bRecordOk, "svtools.filter", "polygon record has more polygons than we can handle");
+ if (!bRecordOk)
+ return Polygon();
+
Polygon aPolygon(nPoints);
for (sal_uInt16 i = nStartIndex ; i < nPoints && pWMF->good(); i++ )
{