fix potential hang here

Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0

fix potential hang here
Change-Id: Id62cdb90420b9ccf4e98fc1af46c70db6ed60ee0
7eef63bb · Caolán McNamara · ac46405c · 7eef63bb
Kaydet (Commit) 7eef63bb authored Tem 10, 2015 tarafından Caolán McNamara
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 8 deletions

winwmf.cxx vcl/source/filter/wmf/winwmf.cxx +13 -8

No files found.
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1735,14 +1735,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                }
                break;
            }
-            nPos += nRSize * 2;
-             if ( nPos <= nEnd )
-                 pStm->Seek( nPos );
-             else
-             {
-                 pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
-                 bRet = false;
-             }
+
+            const sal_uInt32 nAvailableBytes = nEnd - nPos;
+            const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+            if (nRSize <= nMaxPossibleRecordSize)
+            {
+                nPos += nRSize * 2;
+                pStm->Seek( nPos );
+            }
+            else
+            {
+                pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                bRet = false;
+            }
        }
    }
    else