diff options
| -rw-r--r-- | emfio/source/reader/wmfreader.cxx | 23 | ||||
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/exttextout-2.wmf | bin | 0 -> 54196 bytes |
2 files changed, 12 insertions, 11 deletions
diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index e82d756f28b2..eafff0378716 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -1387,7 +1387,7 @@ namespace emfio if( mnEndPos - mnStartPos ) { - bool bEMFAvailable = false; + bool bEMFAvailable = false; while( true ) { mnCurrentAction++; @@ -1404,6 +1404,15 @@ namespace emfio break; } + + const sal_uInt32 nAvailableBytes = mnEndPos - nPos; + const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; + if (mnRecSize > nMaxPossibleRecordSize) + { + mpInputStream->SetError(SVSTREAM_FILEFORMAT_ERROR); + break; + } + if ( !bEMFAvailable ) { if( !maBmpSaveList.empty() @@ -1448,16 +1457,8 @@ namespace emfio } } - const sal_uInt32 nAvailableBytes = mnEndPos - nPos; - const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; - - if (mnRecSize <= nMaxPossibleRecordSize) - { - nPos += mnRecSize * 2; - mpInputStream->Seek(nPos); - } - else - mpInputStream->SetError( SVSTREAM_FILEFORMAT_ERROR ); + nPos += mnRecSize * 2; + mpInputStream->Seek(nPos); } } else diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/exttextout-2.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/exttextout-2.wmf Binary files differnew file mode 100644 index 000000000000..02c72ad88fa8 --- /dev/null +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/exttextout-2.wmf |