[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf |binary
 vcl/source/filter/wmf/winwmf.cxx                      |   10 +++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 902be1faa4c18b1381e77e4e1630edf6ed301556
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 10 08:40:42 2015 +0100

    avoid endless loop with busted wmf
    
    Change-Id: I104de360f2e861e959ad2dad434a768440877f6f
    (cherry picked from commit fd2749455fe25e24b448a44f9ada6113e5ac0d13)
    Reviewed-on: https://gerrit.libreoffice.org/16915
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf
new file mode 100644
index 0000000..7ba05cb
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index b7e63d7..bee19b6 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1372,9 +1372,13 @@ void WMFReader::ReadWMF()
                         }
                     }
                 }
-                nPos += nRecSize * 2;
-                if ( nPos <= nEndPos )
-                    pWMF->Seek( nPos  );
+                const sal_uInt32 nAvailableBytes = nEndPos - nPos;
+                const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+                if (nRecSize <= nMaxPossibleRecordSize)
+                {
+                    nPos += nRecSize * 2;
+                    pWMF->Seek(nPos);
+                }
                 else
                     pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
             }