[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx                       |    2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit b7bcf8ccc15f7d80a3966a340b987dfa9fd41bd0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jul 12 21:07:21 2015 +0100

    emf: test for negative numbers
    
    Change-Id: I9d9b6f3e9592ca7b85cee5422e43d4ca46b8bb36
    (cherry picked from commit 4661b2dd34bd7c56b6d783d49f265e9ecde19caa)
    Reviewed-on: https://gerrit.libreoffice.org/16970
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf
new file mode 100644
index 0000000..bbc0285
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 62ba08b..bd48610 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1425,7 +1425,7 @@ bool EnhWMFReader::ReadEnhWMF()
                     DBG_ASSERT( ( nOptions & ( ETO_PDY | ETO_GLYPH_INDEX ) ) == 0, "SJ: ETO_PDY || ETO_GLYPH_INDEX in EMF" );
 
                     Point aPos( ptlReferenceX, ptlReferenceY );
-                    if ( nLen && nLen < static_cast<sal_Int32>( SAL_MAX_UINT32 / sizeof(sal_Int32) ) )
+                    if ( nLen > 0 && nLen < static_cast<sal_Int32>( SAL_MAX_UINT32 / sizeof(sal_Int32) ) )
                     {
                         if ( offDx && (( nCurPos + offDx + nLen * 4 ) <= nNextPos ) )
                         {