[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf |binary
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf     |binary
 vcl/source/filter/wmf/winwmf.cxx                          |    3 ++-
 3 files changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 28ed3227267f7a00273595a60206744fd3c78b96
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Dec 10 20:51:58 2016 +0000

    oss-fuzz: handle W_META_CREATEFONTINDIRECT like EMR_EXTCREATEFONTINDIRECTW
    
    Change-Id: Iaa142d5d0ac0f00e89e8b7d7ffdef8137157cec9
    (cherry picked from commit e718ac0ae415bba2988c96c36995755bbfd9df7f)
    (cherry picked from commit d3ea20e55ca7d82b6121f7ed3db5fd170fcac94f)
    Reviewed-on: https://gerrit.libreoffice.org/31839
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf
new file mode 100644
index 0000000..29c534f
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/facename-1.wmf differ
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf
new file mode 100644
index 0000000..e2fac15
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/seek-1.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 1c65342..c4f7e78 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -885,7 +885,8 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
         case W_META_CREATEFONTINDIRECT:
         {
             Size aFontSize;
-            char lfFaceName[LF_FACESIZE];
+            char lfFaceName[LF_FACESIZE+1];
+            lfFaceName[LF_FACESIZE] = 0;
             sal_Int16 lfEscapement = 0;
             sal_Int16 lfOrientation = 0;
             sal_Int16 lfWeight = 0;