diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-10 11:34:03 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-07-10 11:55:39 +0100 |
| commit | 7eef63bb2a4d14cb35201f84f38855910f468e20 (patch) | |
| tree | ed16dd22f7bf4a1ac2839986e129cb49aba0b046 /vcl | |
| parent | ac46405ca62fcc7d7a7e8004c0c44b330956e39c (diff) | |
fix potential hang here
Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 7b87f68a0013..52f228ef1c99 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm ) } break; } - nPos += nRSize * 2; - if ( nPos <= nEnd ) - pStm->Seek( nPos ); - else - { - pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); - bRet = false; - } + + const sal_uInt32 nAvailableBytes = nEnd - nPos; + const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; + if (nRSize <= nMaxPossibleRecordSize) + { + nPos += nRSize * 2; + pStm->Seek( nPos ); + } + else + { + pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); + bRet = false; + } } } else |