vcl/source/filter/wmf/winwmf.cxx | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
New commits:
commit 28548bfaa73b643279620507f6247d7bc247a1ae
Author: Caolán McNamara <caol...@redhat.com>
Date: Fri Mar 3 09:33:12 2017 +0000
ofz: avoid oom
Change-Id: Ib3f7ce3e8e7365622f89de5c63615ae321149aa6
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 5ee86b9..44e8c53 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1115,7 +1115,13 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
{ // first EMF comment
nEMFRecCount = nComRecCount;
nEMFSize = nEMFTotalSize;
- pEMFStream =
o3tl::make_unique<SvMemoryStream>(nEMFSize, 0);
+ if (nEMFSize > pWMF->remainingSize())
+ {
+ SAL_WARN("vcl.wmf", "emf size claims to be
larger than remaining data");
+ pEMFStream.reset();
+ }
+ else
+ pEMFStream =
o3tl::make_unique<SvMemoryStream>(nEMFSize, 0);
}
else if( ( nEMFRecCount != nComRecCount ) || (
nEMFSize != nEMFTotalSize ) ) // add additional checks here
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
