[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                      |    2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 5ef9b838791ebb7c4d5695dce5e5fd12eddcab96
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 13 09:10:12 2015 +0100

    emf: fix hang
    
    Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b
    (cherry picked from commit 8695633023cc321a095753db98bdc69d2aeee058)
    Reviewed-on: https://gerrit.libreoffice.org/16977
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf
new file mode 100644
index 0000000..634fccd
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index d55349f..62ba08b 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF()
 
             SAL_INFO("vcl.emf", "\tGDI comment, length: " << length);
 
-            if( pWMF->good() && length >= 4 ) {
+            if( pWMF->good() && length >= 4 && length <= pWMF->remainingSize() ) {
                 sal_uInt32 id;
 
                 pWMF->ReadUInt32( id );