diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-03 09:33:12 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-03 10:39:51 +0000 |
| commit | 28548bfaa73b643279620507f6247d7bc247a1ae (patch) | |
| tree | 66c1e829115feb45ac1cea2bd11434e64b80e3c1 | |
| parent | tdf#90856 Hide "Format Area" command for line objects in Calc (diff) | |
| download | core-28548bfaa73b643279620507f6247d7bc247a1ae.tar.gz core-28548bfaa73b643279620507f6247d7bc247a1ae.zip | |
ofz: avoid oom
Change-Id: Ib3f7ce3e8e7365622f89de5c63615ae321149aa6
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 5ee86b972f9e..44e8c530a7db 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1115,7 +1115,13 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc ) { // first EMF comment nEMFRecCount = nComRecCount; nEMFSize = nEMFTotalSize; - pEMFStream = o3tl::make_unique<SvMemoryStream>(nEMFSize, 0); + if (nEMFSize > pWMF->remainingSize()) + { + SAL_WARN("vcl.wmf", "emf size claims to be larger than remaining data"); + pEMFStream.reset(); + } + else + pEMFStream = o3tl::make_unique<SvMemoryStream>(nEMFSize, 0); } else if( ( nEMFRecCount != nComRecCount ) || ( nEMFSize != nEMFTotalSize ) ) // add additional checks here { |