diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2014-06-05 17:36:52 +0200 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2014-06-05 17:36:52 +0200 |
| commit | 90f0af7a9cabcfe9006608b3444a54ef6ff340f5 (patch) | |
| tree | 8a017c12fac8d28662e63f3fc4535441b075bcd6 /vcl | |
| parent | c7aed931dd3d3f51c1d5d6ef17650f31528fb04b (diff) | |
WMF record size < 3 is clearly broken
...so we should not attempt to (mis-)interpret such broken input.
Change-Id: I97f4f46fdfc0dfe6f9aff42917d23634b844c7f0
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1238-1.wmf (renamed from vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1238-1.wmf) | bin | 382 -> 382 bytes | |||
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1245-1.wmf (renamed from vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1245-1.wmf) | bin | 382 -> 382 bytes | |||
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 18 |
3 files changed, 12 insertions, 6 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1238-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1238-1.wmf Binary files differindex 10da32742570..10da32742570 100644 --- a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1238-1.wmf +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1238-1.wmf diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1245-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1245-1.wmf Binary files differindex 10da32742570..10da32742570 100644 --- a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2007-1245-1.wmf +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2007-1245-1.wmf diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 4c2c95c04b42..8079263ded4f 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1377,13 +1377,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm ) { pStm->ReadUInt32( nRSize ).ReadUInt16( nFunction ); - if( pStm->GetError() || ( nRSize < 3 ) || ( nRSize==3 && nFunction==0 ) || pStm->IsEof() ) + if( pStm->GetError() ) { - if( pStm->IsEof() ) - { - pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); - bRet = false; - } + bRet = false; + break; + } + else if ( nRSize==3 && nFunction==0 ) + { + break; + } + else if ( nRSize < 3 || pStm->IsEof() ) + { + pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); + bRet = false; break; } switch( nFunction ) |