[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                      |    2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit bcf9f7c7e06ee97106b5a555a97599e6b0ed1c13
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 13 09:10:12 2015 +0100

    emf: fix hang
    
    Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b
    (cherry picked from commit 8695633023cc321a095753db98bdc69d2aeee058)
    Reviewed-on: https://gerrit.libreoffice.org/16976
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf
new file mode 100644
index 0000000..634fccd
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index f02871d..de78559 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF()
 
             SAL_INFO("vcl.emf", "\tGDI comment, length: " << length);
 
-            if( pWMF->good() && length >= 4 ) {
+            if( pWMF->good() && length >= 4 && length <= pWMF->remainingSize() ) {
                 sal_uInt32 id;
 
                 pWMF->ReadUInt32( id );