diff options
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 7b87f68a0013..52f228ef1c99 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm ) } break; } - nPos += nRSize * 2; - if ( nPos <= nEnd ) - pStm->Seek( nPos ); - else - { - pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); - bRet = false; - } + + const sal_uInt32 nAvailableBytes = nEnd - nPos; + const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; + if (nRSize <= nMaxPossibleRecordSize) + { + nPos += nRSize * 2; + pStm->Seek( nPos ); + } + else + { + pStm->SetError( SVSTREAM_FILEFORMAT_ERROR ); + bRet = false; + } } } else |