[Libreoffice-commits] core.git: vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                      |    2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 8695633023cc321a095753db98bdc69d2aeee058
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 13 09:10:12 2015 +0100

    emf: fix hang
    
    Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf
new file mode 100644
index 0000000..634fccd
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index e0eba92..62d7b5e 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF()
 
             SAL_INFO("vcl.emf", "\tGDI comment, length: " << length);
 
-            if( pWMF->good() && length >= 4 ) {
+            if( pWMF->good() && length >= 4 && length <= pWMF->remainingSize() ) {
                 sal_uInt32 id;
 
                 pWMF->ReadUInt32( id );