[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/filter/wmf/winwmf.cxx |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

New commits:
commit 7eef63bb2a4d14cb35201f84f38855910f468e20
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 10 11:34:03 2015 +0100

    fix potential hang here
    
    Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 7b87f68..52f228e 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                 }
                 break;
             }
-            nPos += nRSize * 2;
-             if ( nPos <= nEnd )
-                 pStm->Seek( nPos );
-             else
-             {
-                 pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
-                 bRet = false;
-             }
+
+            const sal_uInt32 nAvailableBytes = nEnd - nPos;
+            const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+            if (nRSize <= nMaxPossibleRecordSize)
+            {
+                nPos += nRSize * 2;
+                pStm->Seek( nPos );
+            }
+            else
+            {
+                pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                bRet = false;
+            }
         }
     }
     else