emfio/source/reader/wmfreader.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
New commits: commit b5344daa0cfc31cf187832261651e5490b19d922 Author: Caolán McNamara <caol...@redhat.com> Date: Mon Nov 13 21:06:57 2017 +0000 ofz: further limit exttextout to record size is smaller than stream size Change-Id: I5f59db9e0c32f601537860d7574044b713d1c39d Reviewed-on: https://gerrit.libreoffice.org/44696 Tested-by: Jenkins <c...@libreoffice.org> Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index b27b49e307f7..97861c225306 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -553,7 +553,8 @@ namespace emfio aRect = tools::Rectangle( aPt1, aPt2 ); } - auto nRemainingSize = mpInputStream->remainingSize(); + auto nMaxStreamPos = nRecordPos + (nRecordSize << 1); + auto nRemainingSize = std::min(mpInputStream->remainingSize(), nMaxStreamPos - mpInputStream->Tell()); if (nRemainingSize < static_cast<sal_uInt32>(nOriginalBlockLen)) { SAL_WARN("vcl.wmf", "exttextout record claimed more data than the stream can provide"); @@ -568,7 +569,6 @@ namespace emfio if ( nNewTextLen ) { std::unique_ptr<long[]> pDXAry, pDYAry; - auto nMaxStreamPos = nRecordPos + ( nRecordSize << 1 ); auto nDxArySize = nMaxStreamPos - mpInputStream->Tell(); auto nDxAryEntries = nDxArySize >> 1; bool bUseDXAry = false;
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits