filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met |binary filter/source/graphicfilter/ios2met/ios2met.cxx | 9 ++++++++- 2 files changed, 8 insertions(+), 1 deletion(-)
New commits: commit eb6d27321d2d5f9d069c4a3cbcc9bc6e5b4c98ab Author: Caolán McNamara <caol...@redhat.com> Date: Mon Nov 17 15:22:08 2014 +0000 afl: divide-by-zero Change-Id: Ided311873f654c0f40dae57c8876a6412ee97d3e diff --git a/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met b/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met new file mode 100644 index 0000000..62ccf48 Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/afl-divide-zero-1.met differ diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index 5f1d17f..aa29380 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -2357,7 +2357,14 @@ void OS2METReader::ReadField(sal_uInt16 nFieldType, sal_uInt16 nFieldSize) pOS2MET->SeekRel(4); nStartIndex=ReadBigEndianWord(); pOS2MET->SeekRel(3); - pOS2MET->ReadUChar( nbyte ); nBytesPerCol=((sal_uInt16)nbyte) & 0x00ff; + pOS2MET->ReadUChar( nbyte ); + nBytesPerCol=((sal_uInt16)nbyte) & 0x00ff; + if (nBytesPerCol == 0) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=4; + break; + } nEndIndex=nStartIndex+(nElemLen-11)/nBytesPerCol; for (i=nStartIndex; i<nEndIndex; i++) { if (nBytesPerCol > 3) pOS2MET->SeekRel(nBytesPerCol-3);
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits