[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf |binary
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf     |binary
 vcl/source/filter/wmf/winwmf.cxx                          |    3 ++-
 3 files changed, 2 insertions(+), 1 deletion(-)

New commits:
commit d3ea20e55ca7d82b6121f7ed3db5fd170fcac94f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Dec 10 20:51:58 2016 +0000

    oss-fuzz: handle W_META_CREATEFONTINDIRECT like EMR_EXTCREATEFONTINDIRECTW
    
    Change-Id: Iaa142d5d0ac0f00e89e8b7d7ffdef8137157cec9
    (cherry picked from commit e718ac0ae415bba2988c96c36995755bbfd9df7f)

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf
new file mode 100644
index 0000000..29c534f
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf differ
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf
new file mode 100644
index 0000000..e2fac15
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index a93c79a..1544def 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -885,7 +885,8 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
         case W_META_CREATEFONTINDIRECT:
         {
             Size aFontSize;
-            char lfFaceName[LF_FACESIZE];
+            char lfFaceName[LF_FACESIZE+1];
+            lfFaceName[LF_FACESIZE] = 0;
             sal_Int16 lfEscapement = 0;
             sal_Int16 lfOrientation = 0;
             sal_Int16 lfWeight = 0;