check escher seeks

Change-Id: I4cb523e8654defa25e75ebd54f1e125ea02e1cf9
Reviewed-on: https://gerrit.libreoffice.org/36281
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit a1147a34d85742fd5d9410efac6fc59ac2fd1574)

1 files changed, 11 insertions, 7 deletions

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index a7c6a5a2860a..5e873f8a6147 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -222,13 +222,20 @@ DffPropertyReader::DffPropertyReader( const SvxMSDffManager& rMan )
     InitializePropSet( DFF_msofbtOPT );
 }
 
+bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
+{
+    const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+    return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
+}
+
 void DffPropertyReader::SetDefaultPropSet( SvStream& rStCtrl, sal_uInt32 nOffsDgg ) const
 {
     delete pDefaultPropSet;
     sal_uInt32 nMerk = rStCtrl.Tell();
-    rStCtrl.Seek( nOffsDgg );
+    bool bOk = checkSeek(rStCtrl, nOffsDgg);
     DffRecordHeader aRecHd;
-    bool bOk = ReadDffRecordHeader( rStCtrl, aRecHd );
+    if (bOk)
+        bOk = ReadDffRecordHeader( rStCtrl, aRecHd );
     if (bOk && aRecHd.nRecType == DFF_msofbtDggContainer)
     {
         if ( SvxMSDffManager::SeekToRec( rStCtrl, DFF_msofbtOPT, aRecHd.GetRecEndFilePos() ) )
@@ -5839,13 +5846,10 @@ void SvxMSDffManager::CheckTxBxStoryChain()
     and remembering the File-Offsets for each Blip
                        ============
 ******************************************************************************/
-void SvxMSDffManager::GetCtrlData( sal_uInt32 nOffsDgg_ )
+void SvxMSDffManager::GetCtrlData(sal_uInt32 nOffsDggL)
 {
-    // absolutely remember Start Offset, in case we have to position again
-    sal_uInt32 nOffsDggL = nOffsDgg_;
-
     // position control stream
-    if (nOffsDggL != rStCtrl.Seek(nOffsDggL))
+    if (!checkSeek(rStCtrl, nOffsDggL))
         return;
 
     sal_uInt8   nVer;