[Libreoffice-commits] core.git: 2 commits - vcl/source vcl/workben

[Caolán McNamara]

 vcl/source/filter/wmf/winwmf.cxx |   17 ++++++++++++-----
 vcl/workben/fftester.cxx         |    2 --
 2 files changed, 12 insertions(+), 7 deletions(-)

New commits:
commit e9bd695a063e111cdc002b73a6a5cccbc52ef4d3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Apr 2 11:52:06 2017 +0100

    ofz: avoid oom
    
    Change-Id: Ibffae78a1186492300c237e85089702491cf4a0f

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 94783f8879d4..0ce2ff3eccac 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1131,18 +1131,25 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
                             }
                             nEMFRec++;
 
-                            if( pEMFStream && nCurRecSize + 34 > nLen )
+                            if (pEMFStream && nCurRecSize + 34 > nLen)
                             {
                                 nEMFRecCount = 0xFFFFFFFF;
                                 pEMFStream.reset();
                             }
 
-                            if( pEMFStream )
+                            if (pEMFStream && nCurRecSize > pWMF->remainingSize())
                             {
-                                std::unique_ptr<sal_Int8[]> pBuf(new sal_Int8[ nCurRecSize ]);
-                                sal_uInt32 nCount = pWMF->ReadBytes(pBuf.get(), nCurRecSize);
+                                SAL_WARN("vcl.wmf", "emf record size claims to be larger than remaining data");
+                                nEMFRecCount = 0xFFFFFFFF;
+                                pEMFStream.reset();
+                            }
+
+                            if (pEMFStream)
+                            {
+                                std::vector<sal_Int8> aBuf(nCurRecSize);
+                                sal_uInt32 nCount = pWMF->ReadBytes(aBuf.data(), nCurRecSize);
                                 if( nCount == nCurRecSize )
-                                    pEMFStream->WriteBytes(pBuf.get(), nCount);
+                                    pEMFStream->WriteBytes(aBuf.data(), nCount);
                             }
                         }
                     }
commit 4f2825f590f4d4921d9336961fd727e76b525b92
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Apr 2 11:49:12 2017 +0100

    align fftester and wmffuzzer
    
    Change-Id: Ib0017cfd290b41fc886b5516d2f50ee219185d5a

diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx
index 3b7a1619d45e..63e33e14b735 100644
--- a/vcl/workben/fftester.cxx
+++ b/vcl/workben/fftester.cxx
@@ -115,8 +115,6 @@ try_again:
                 GDIMetaFile aGDIMetaFile;
                 SvFileStream aFileStream(out, StreamMode::READ);
                 ret = (int) ReadWindowMetafile(aFileStream, aGDIMetaFile);
-                BitmapEx aTarget;
-                (void)aGDIMetaFile.CreateThumbnail(aTarget);
             }
             else if (strcmp(argv[2], "jpg") == 0)
             {