[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                          |    5 +++++
 2 files changed, 5 insertions(+)

New commits:
commit 071b6681564242d418d086e5991e1dbacc3b897c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Nov 12 14:56:43 2013 +0000

    Resolves: fdo#71307 out polygons are limited to 16bit point count
    
    Change-Id: I4dbe9145466d6d93ebd3dea7f4fe434c9ee3de19
    (cherry picked from commit cdd351b1487a8a97f481a9165d9cd361aaee2ca4)
    Reviewed-on: https://gerrit.libreoffice.org/6655
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf
new file mode 100644
index 0000000..b89db21
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/fail/fdo71307-2.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index ad2a3a6..de8b780 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -344,6 +344,11 @@ void EnhWMFReader::ReadAndDrawPolygon(Drawer drawer, const sal_Bool skipFirst)
 template <class T>
 Polygon EnhWMFReader::ReadPolygon(sal_uInt32 nStartIndex, sal_uInt32 nPoints)
 {
+    bool bRecordOk = nPoints <= SAL_MAX_UINT16;
+    SAL_WARN_IF(!bRecordOk, "svtools.filter", "polygon record has more polygons than we can handle");
+    if (!bRecordOk)
+        return Polygon();
+
     Polygon aPolygon(nPoints);
     for (sal_uInt16 i = nStartIndex ; i < nPoints && pWMF->good(); i++ )
     {