[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/source

[Caolán McNamara]

 vcl/source/filter/wmf/winwmf.cxx |   21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

New commits:
commit e0d7f9a7ca24f06b393f37a34c099cd10b9d2da0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 10 11:34:03 2015 +0100

    fix potential hang here
    
    Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0
    (cherry picked from commit 7eef63bb2a4d14cb35201f84f38855910f468e20)
    Reviewed-on: https://gerrit.libreoffice.org/16922
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 5e25949..7c153c7 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                 }
                 break;
             }
-            nPos += nRSize * 2;
-             if ( nPos <= nEnd )
-                 pStm->Seek( nPos );
-             else
-             {
-                 pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
-                 bRet = false;
-             }
+
+            const sal_uInt32 nAvailableBytes = nEnd - nPos;
+            const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+            if (nRSize <= nMaxPossibleRecordSize)
+            {
+                nPos += nRSize * 2;
+                pStm->Seek( nPos );
+            }
+            else
+            {
+                pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                bRet = false;
+            }
         }
     }
     else