fix potential hang here

Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0
(cherry picked from commit 7eef63bb)
Reviewed-on: https://gerrit.libreoffice.org/16922Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>

vcl/source/filter/wmf/winwmf.cxx

@@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                 }
                 break;
             }
-            nPos += nRSize * 2;
-             if ( nPos <= nEnd )
-                 pStm->Seek( nPos );
-             else
-             {
-                 pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
-                 bRet = false;
-             }
+
+            const sal_uInt32 nAvailableBytes = nEnd - nPos;
+            const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+            if (nRSize <= nMaxPossibleRecordSize)
+            {
+                nPos += nRSize * 2;
+                pStm->Seek( nPos );
+            }
+            else
+            {
+                pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                bRet = false;
+            }
         }
     }
     else