emf: fix hang

Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b
(cherry picked from commit 86956330)
Reviewed-on: https://gerrit.libreoffice.org/16976Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>

vcl/source/filter/wmf/enhwmf.cxx

@@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF()
 
             SAL_INFO("vcl.emf", "\tGDI comment, length: " << length);
 
-            if( pWMF->good() && length >= 4 ) {
+            if( pWMF->good() && length >= 4 && length <= pWMF->remainingSize() ) {
                 sal_uInt32 id;
 
                 pWMF->ReadUInt32( id );