[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara]

 emfio/source/reader/wmfreader.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit b5344daa0cfc31cf187832261651e5490b19d922
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Nov 13 21:06:57 2017 +0000

    ofz: further limit exttextout to record size is smaller than stream size
    
    Change-Id: I5f59db9e0c32f601537860d7574044b713d1c39d
    Reviewed-on: https://gerrit.libreoffice.org/44696
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx
index b27b49e307f7..97861c225306 100644
--- a/emfio/source/reader/wmfreader.cxx
+++ b/emfio/source/reader/wmfreader.cxx
@@ -553,7 +553,8 @@ namespace emfio
                         aRect = tools::Rectangle( aPt1, aPt2 );
                     }
 
-                    auto nRemainingSize = mpInputStream->remainingSize();
+                    auto nMaxStreamPos = nRecordPos + (nRecordSize << 1);
+                    auto nRemainingSize = std::min(mpInputStream->remainingSize(), nMaxStreamPos - mpInputStream->Tell());
                     if (nRemainingSize < static_cast<sal_uInt32>(nOriginalBlockLen))
                     {
                         SAL_WARN("vcl.wmf", "exttextout record claimed more data than the stream can provide");
@@ -568,7 +569,6 @@ namespace emfio
                     if ( nNewTextLen )
                     {
                         std::unique_ptr<long[]> pDXAry, pDYAry;
-                        auto nMaxStreamPos = nRecordPos + ( nRecordSize << 1 );
                         auto nDxArySize =  nMaxStreamPos - mpInputStream->Tell();
                         auto nDxAryEntries = nDxArySize >> 1;
                         bool        bUseDXAry = false;