[Libreoffice-commits] core.git: filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met |binary
 filter/source/graphicfilter/ios2met/ios2met.cxx       |    9 ++++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

New commits:
commit eb6d27321d2d5f9d069c4a3cbcc9bc6e5b4c98ab
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Nov 17 15:22:08 2014 +0000

    afl: divide-by-zero
    
    Change-Id: Ided311873f654c0f40dae57c8876a6412ee97d3e

diff --git a/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met b/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met
new file mode 100644
index 0000000..62ccf48
Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met differ
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index 5f1d17f..aa29380 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2357,7 +2357,14 @@ void OS2METReader::ReadField(sal_uInt16 nFieldType, sal_uInt16 nFieldSize)
                     pOS2MET->SeekRel(4);
                     nStartIndex=ReadBigEndianWord();
                     pOS2MET->SeekRel(3);
-                    pOS2MET->ReadUChar( nbyte ); nBytesPerCol=((sal_uInt16)nbyte) & 0x00ff;
+                    pOS2MET->ReadUChar( nbyte );
+                    nBytesPerCol=((sal_uInt16)nbyte) & 0x00ff;
+                    if (nBytesPerCol == 0)
+                    {
+                        pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
+                        ErrorCode=4;
+                        break;
+                    }
                     nEndIndex=nStartIndex+(nElemLen-11)/nBytesPerCol;
                     for (i=nStartIndex; i<nEndIndex; i++) {
                         if (nBytesPerCol > 3) pOS2MET->SeekRel(nBytesPerCol-3);