diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-04-08 21:41:22 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-04-08 21:42:29 +0100 |
| commit | cb13c3bc7c082246b255f270faf9459f1c24412c (patch) | |
| tree | 96d9adddd19c75dc9e48a331228b75713136e0a0 /vcl | |
| parent | 2fc6d1a1097cf52aa0845b016139e0bdbdfdeb6d (diff) | |
ofz#1069 avoid oom
Change-Id: I7b567f49651496969ca0da56de702f10e6a39494
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/wmf/enhwmf.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index 75089260335d..12f0d6232ff5 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -590,6 +590,8 @@ void EnhWMFReader::ReadAndDrawPolyPolygon() pWMF->SeekRel( 0x10 ); // Number of polygons pWMF->ReadUInt32( nPoly ).ReadUInt32( nGesPoints ); + if (pWMF->Tell() >= nEndPos) + return; if ( pWMF->good() && ( nGesPoints < SAL_MAX_UINT32 / sizeof(Point) ) && //check against numeric overflowing ( nPoly < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) && |