[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/gdi/svmconverter.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 68598e06bc5a5fefb917f436d44bec1623d0fbeb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Mar 15 16:32:43 2017 +0000

    ofz: infinite loop
    
    Change-Id: I00eb3c1d97d27755c8b34676d2fa73a72fc8f9d7

diff --git a/vcl/source/gdi/svmconverter.cxx b/vcl/source/gdi/svmconverter.cxx
index 1b2a8a8..72efcfa 100644
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -926,7 +926,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                         ImplReadUnicodeComment( nUnicodeCommentStreamPos, rIStm, aStr );
                     rMtf.AddAction( new MetaTextAction( aPt, aStr, nIndex, nLen ) );
                 }
-                rIStm.Seek( nActBegin + nActionSize );
+
+                if (nActionSize < 24)
+                    rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+                else
+                    rIStm.Seek(nActBegin + nActionSize);
             }
             break;