[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/filter/wmf/winwmf.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 28548bfaa73b643279620507f6247d7bc247a1ae
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 3 09:33:12 2017 +0000

    ofz: avoid oom
    
    Change-Id: Ib3f7ce3e8e7365622f89de5c63615ae321149aa6

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 5ee86b9..44e8c53 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1115,7 +1115,13 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
                             {   // first EMF comment
                                 nEMFRecCount    = nComRecCount;
                                 nEMFSize        = nEMFTotalSize;
-                                pEMFStream = o3tl::make_unique<SvMemoryStream>(nEMFSize, 0);
+                                if (nEMFSize > pWMF->remainingSize())
+                                {
+                                    SAL_WARN("vcl.wmf", "emf size claims to be larger than remaining data");
+                                    pEMFStream.reset();
+                                }
+                                else
+                                    pEMFStream = o3tl::make_unique<SvMemoryStream>(nEMFSize, 0);
                             }
                             else if( ( nEMFRecCount != nComRecCount ) || ( nEMFSize != nEMFTotalSize ) ) // add additional checks here
                             {