another avoid endless loop with busted wmf

Change-Id: Ie4068fdc1e54e0ad3e55354938a4c5e1459e7fe0
(cherry picked from commit 7ffe6aeb)
Reviewed-on: https://gerrit.libreoffice.org/17682Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>

vcl/source/filter/wmf/enhwmf.cxx

@@ -637,14 +637,15 @@ bool EnhWMFReader::ReadEnhWMF()
             break;
         }
 
-        nNextPos = pWMF->Tell() + ( nRecSize - 8 );
-
-        if ( !pWMF->good() || nNextPos > nEndPos )
+        const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF->Tell() + 8;
+        if (nRecSize > nMaxPossibleRecSize)
         {
             bStatus = false;
             break;
         }
 
+        nNextPos = pWMF->Tell() + ( nRecSize - 8 );
+
         if(  !aBmpSaveList.empty()
           && ( nRecType != EMR_STRETCHBLT )
           && ( nRecType != EMR_STRETCHDIBITS )