[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - vcl/source

[Caolán McNamara]

 vcl/source/gdi/svmconverter.cxx |   49 ++++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 19 deletions(-)

New commits:
commit d301dc1b2bdcc345fd8d91c0a973b1960a7e1d55
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 9 09:21:39 2017 +0000

    Resolves: ofz#576 unexpected exception with invalid fraction
    
    (cherry picked from commit cff6cdb2ee37e836b9bab39500d24fcedc360121)
    
    Change-Id: I1d653775e88e9fa2ba7b62fce39d52fc21ffe363
    Reviewed-on: https://gerrit.libreoffice.org/34069
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 73c62b0..de1cf5a 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -129,19 +129,26 @@ void ImplWriteColor( SvStream& rOStm, const Color& rColor )
     rOStm.WriteInt16( nVal );
 }
 
-void ImplReadMapMode( SvStream& rIStm, MapMode& rMapMode )
+bool ImplReadMapMode(SvStream& rIStm, MapMode& rMapMode)
 {
-    Point   aOrg;
-    sal_Int32   nXNum;
-    sal_Int32   nXDenom;
-    sal_Int32   nYNum;
-    sal_Int32   nYDenom;
-    sal_Int16   nUnit;
-
-    rIStm.ReadInt16( nUnit );
-    ReadPair( rIStm, aOrg );
-    rIStm.ReadInt32( nXNum ).ReadInt32( nXDenom ).ReadInt32( nYNum ).ReadInt32( nYDenom );
+    sal_Int16 nUnit(0);
+    rIStm.ReadInt16(nUnit);
+
+    Point aOrg;
+    ReadPair(rIStm, aOrg);
+
+    sal_Int32 nXNum(0), nXDenom(0), nYNum(0), nYDenom(0);
+    rIStm.ReadInt32(nXNum).ReadInt32(nXDenom).ReadInt32(nYNum).ReadInt32(nYDenom);
+
+    if (!rIStm.good() || nXDenom == 0 || nYDenom == 0)
+    {
+        SAL_WARN("vcl.gdi", "Parsing error: invalid mapmode fraction");
+        return false;
+    }
+
     rMapMode = MapMode( (MapUnit) nUnit, aOrg, Fraction( nXNum, nXDenom ), Fraction( nYNum, nYDenom ) );
+
+    return true;
 }
 
 void ImplWriteMapMode( SvStream& rOStm, const MapMode& rMapMode )
@@ -506,7 +513,6 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
     bool                bFatLine = false;
 
     // TODO: fix reindentation below if you can accept being blamed by the SCM
-        MapMode     aMapMode;
         tools::Polygon     aActionPoly;
         Rectangle   aRect;
         Point       aPt, aPt1;
@@ -516,7 +522,12 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
         sal_uInt32  nUnicodeCommentStreamPos = 0;
         sal_Int32       nUnicodeCommentActionNumber = 0;
 
-        ImplReadMapMode( rIStm, aMapMode );             // MapMode
+        rMtf.SetPrefSize( aPrefSz );
+
+        MapMode aMapMode;
+        if (ImplReadMapMode(rIStm, aMapMode))           // MapMode
+            rMtf.SetPrefMapMode(aMapMode);
+
         sal_Int32 nActions(0);
         rIStm.ReadInt32( nActions );                    // Action count
         if (nActions < 0)
@@ -533,8 +544,6 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
             nActions = nMaxPossibleActions;
         }
 
-        rMtf.SetPrefSize( aPrefSz );
-        rMtf.SetPrefMapMode( aMapMode );
         size_t nLastPolygonAction(0);
 
         for (sal_Int32 i = 0; i < nActions && rIStm.good(); ++i)
@@ -1060,11 +1069,13 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case GDI_MAPMODE_ACTION:
                 {
-                    ImplReadMapMode( rIStm, aMapMode );
-                    rMtf.AddAction( new MetaMapModeAction( aMapMode ) );
+                    if (ImplReadMapMode(rIStm, aMapMode))
+                    {
+                        rMtf.AddAction(new MetaMapModeAction(aMapMode));
 
-                    // #106172# Track font relevant data in shadow VDev
-                    aFontVDev->SetMapMode( aMapMode );
+                        // #106172# Track font relevant data in shadow VDev
+                        aFontVDev->SetMapMode(aMapMode);
+                    }
                 }
                 break;