avoid endless loop with busted wmf

Change-Id: I104de360f2e861e959ad2dad434a768440877f6f
(cherry picked from commit fd274945)
Reviewed-on: https://gerrit.libreoffice.org/16914Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>

vcl/source/filter/wmf/winwmf.cxx

@@ -1394,9 +1394,13 @@ void WMFReader::ReadWMF()
                         }
                     }
                 }
-                nPos += nRecSize * 2;
-                if ( nPos <= nEndPos )
-                    pWMF->Seek( nPos  );
+                const sal_uInt32 nAvailableBytes = nEndPos - nPos;
+                const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+                if (nRecSize <= nMaxPossibleRecordSize)
+                {
+                    nPos += nRecSize * 2;
+                    pWMF->Seek(nPos);
+                }
                 else
                     pWMF->SetError( SVSTREAM_FILEFORMAT_ERROR );
             }