diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-10 08:40:42 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-06 12:56:03 +0200 |
| commit | 83113db9ed7abe44b4cb30284df7de5e04765b9c (patch) | |
| tree | 468b57ef66b6e98f4d4b428a4076ade1fe970320 /vcl | |
| parent | 9e793f60452a09261112207f4a14f91b0c3c2538 (diff) | |
avoid endless loop with busted wmf
Change-Id: I104de360f2e861e959ad2dad434a768440877f6f
(cherry picked from commit fd2749455fe25e24b448a44f9ada6113e5ac0d13)
Reviewed-on: https://gerrit.libreoffice.org/16914
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf | bin | 0 -> 675 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 10 |
2 files changed, 7 insertions, 3 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf Binary files differnew file mode 100644 index 000000000000..7ba05cb00219 --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index c7d131586c92..5e25949d7ff3 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1394,9 +1394,13 @@ void WMFReader::ReadWMF() } } } - nPos += nRecSize * 2; - if ( nPos <= nEndPos ) - pWMF->Seek( nPos ); + const sal_uInt32 nAvailableBytes = nEndPos - nPos; + const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; + if (nRecSize <= nMaxPossibleRecordSize) + { + nPos += nRecSize * 2; + pWMF->Seek(nPos); + } else pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR ); } |