vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf |binary vcl/source/filter/wmf/enhwmf.cxx | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-)
New commits: commit 5ef9b838791ebb7c4d5695dce5e5fd12eddcab96 Author: Caolán McNamara <caol...@redhat.com> Date: Mon Jul 13 09:10:12 2015 +0100 emf: fix hang Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b (cherry picked from commit 8695633023cc321a095753db98bdc69d2aeee058) Reviewed-on: https://gerrit.libreoffice.org/16977 Reviewed-by: David Tardon <dtar...@redhat.com> Tested-by: David Tardon <dtar...@redhat.com> diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf new file mode 100644 index 0000000..634fccd Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf differ diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx index d55349f..62ba08b 100644 --- a/vcl/source/filter/wmf/enhwmf.cxx +++ b/vcl/source/filter/wmf/enhwmf.cxx @@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF() SAL_INFO("vcl.emf", "\tGDI comment, length: " << length); - if( pWMF->good() && length >= 4 ) { + if( pWMF->good() && length >= 4 && length <= pWMF->remainingSize() ) { sal_uInt32 id; pWMF->ReadUInt32( id );
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits