filter/qa/cppunit/data/met/fail/hang-1.met |binary filter/source/graphicfilter/ios2met/ios2met.cxx | 12 +++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-)
New commits: commit 66744837834e86ea0b7227a704cd0f82f8bdc223 Author: Caolán McNamara <caol...@redhat.com> Date: Wed Jul 15 12:18:10 2015 +0100 don't hang with 0 len causing no progression Change-Id: Ie553dab291c7bfbde033d89b84159aff6b42a160 (cherry picked from commit 15dfcb7f461893f83abcf28bfe01a4164209a160) Reviewed-on: https://gerrit.libreoffice.org/17084 Reviewed-by: Michael Meeks <michael.me...@collabora.com> Tested-by: Michael Meeks <michael.me...@collabora.com> diff --git a/filter/qa/cppunit/data/met/fail/hang-1.met b/filter/qa/cppunit/data/met/fail/hang-1.met new file mode 100644 index 0000000..c1a095d Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/hang-1.met differ diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index 944dab3..0553d1f 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -2240,7 +2240,6 @@ void OS2METReader::ReadImageData(sal_uInt16 nDataID, sal_uInt16 nDataLen) void OS2METReader::ReadFont(sal_uInt16 nFieldSize) { sal_uLong nPos, nMaxPos; - sal_uInt16 nLen; sal_uInt8 nByte, nTripType, nTripType2; OSFont * pF=new OSFont; pF->pSucc=pFontList; pFontList=pF; @@ -2252,7 +2251,13 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize) nMaxPos=nPos+(sal_uLong)nFieldSize; pOS2MET->SeekRel(2); nPos+=2; while (nPos<nMaxPos && pOS2MET->GetError()==0) { - pOS2MET->ReadUChar( nByte ); nLen =((sal_uInt16)nByte) & 0x00ff; + pOS2MET->ReadUChar( nByte ); + sal_uInt16 nLen = ((sal_uInt16)nByte) & 0x00ff; + if (nLen == 0) + { + pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR); + ErrorCode=4; + } pOS2MET->ReadUChar( nTripType ); switch (nTripType) { case 0x02: @@ -2304,7 +2309,8 @@ void OS2METReader::ReadFont(sal_uInt16 nFieldSize) break; } } - nPos+=nLen; pOS2MET->Seek(nPos); + nPos+=nLen; + pOS2MET->Seek(nPos); } }
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits