From 9a06536cc595d3ed82bfd1d3c11e87c1d82710c3 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 5 Feb 2021 21:02:52 +0000
Subject: ofz#30117 OOM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Iaa428f28ba36b21766d9cf2f7c622a179daf0002
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110492
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110513
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
---
 filter/source/graphicfilter/ipict/ipict.cxx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'filter')

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 43b872f09558..16b5c3f6be6e 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -1966,7 +1966,11 @@ void PictReader::ReadPict( SvStream & rStreamPict, GDIMetaFile & rGDIMetaFile )
         else
             nPos+=1+nSize;
 
-        pPict->Seek(nPos);
+        if (!checkSeek(*pPict, nPos))
+        {
+            pPict->SetError(SVSTREAM_FILEFORMAT_ERROR);
+            break;
+        }
     }
 
     pVirDev->SetClipRegion();
-- 
cgit