[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/met/fail/hang-1.met      |binary
 filter/source/graphicfilter/ios2met/ios2met.cxx |   12 +++++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

New commits:
commit a16acd70c711626e8826887ed8ac1052048a0dfa
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jul 15 12:18:10 2015 +0100

    don't hang with 0 len causing no progression
    
    Change-Id: Ie553dab291c7bfbde033d89b84159aff6b42a160
    (cherry picked from commit 15dfcb7f461893f83abcf28bfe01a4164209a160)
    Reviewed-on: https://gerrit.libreoffice.org/17086
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/qa/cppunit/data/met/fail/hang-1.met b/filter/qa/cppunit/data/met/fail/hang-1.met
new file mode 100644
index 0000000..c1a095d
Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/hang-1.met differ
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index d86657d..946d68f 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2258,7 +2258,6 @@ void OS2METReader::ReadImageData(sal_uInt16 nDataID, sal_uInt16 nDataLen)
 void OS2METReader::ReadFont(sal_uInt16 nFieldSize)
 {
     sal_uLong nPos, nMaxPos;
-    sal_uInt16 nLen;
     sal_uInt8 nByte, nTripType, nTripType2;
     OSFont * pF=new OSFont;
     pF->pSucc=pFontList; pFontList=pF;
@@ -2270,7 +2269,13 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize)
     nMaxPos=nPos+(sal_uLong)nFieldSize;
     pOS2MET->SeekRel(2); nPos+=2;
     while (nPos<nMaxPos && pOS2MET->GetError()==0) {
-        pOS2MET->ReadUChar( nByte ); nLen =((sal_uInt16)nByte) & 0x00ff;
+        pOS2MET->ReadUChar( nByte );
+        sal_uInt16 nLen = ((sal_uInt16)nByte) & 0x00ff;
+        if (nLen == 0)
+        {
+            pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
+            ErrorCode=4;
+        }
         pOS2MET->ReadUChar( nTripType );
         switch (nTripType) {
             case 0x02:
@@ -2322,7 +2327,8 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize)
                 break;
             }
         }
-        nPos+=nLen; pOS2MET->Seek(nPos);
+        nPos+=nLen;
+        pOS2MET->Seek(nPos);
     }
 }