Kaydet (Commit) 7cfb3d28 authored tarafından Caolán McNamara's avatar Caolán McNamara

ofz: timeout

Change-Id: I7cdd39f51943bd97e0e0931f44d3338a23044ab0
Reviewed-on: https://gerrit.libreoffice.org/50802Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst 683a68cb
...@@ -1387,7 +1387,7 @@ namespace emfio ...@@ -1387,7 +1387,7 @@ namespace emfio
if( mnEndPos - mnStartPos ) if( mnEndPos - mnStartPos )
{ {
bool bEMFAvailable = false; bool bEMFAvailable = false;
while( true ) while( true )
{ {
mnCurrentAction++; mnCurrentAction++;
...@@ -1404,6 +1404,15 @@ namespace emfio ...@@ -1404,6 +1404,15 @@ namespace emfio
break; break;
} }
const sal_uInt32 nAvailableBytes = mnEndPos - nPos;
const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
if (mnRecSize > nMaxPossibleRecordSize)
{
mpInputStream->SetError(SVSTREAM_FILEFORMAT_ERROR);
break;
}
if ( !bEMFAvailable ) if ( !bEMFAvailable )
{ {
if( !maBmpSaveList.empty() if( !maBmpSaveList.empty()
...@@ -1448,16 +1457,8 @@ namespace emfio ...@@ -1448,16 +1457,8 @@ namespace emfio
} }
} }
const sal_uInt32 nAvailableBytes = mnEndPos - nPos; nPos += mnRecSize * 2;
const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2; mpInputStream->Seek(nPos);
if (mnRecSize <= nMaxPossibleRecordSize)
{
nPos += mnRecSize * 2;
mpInputStream->Seek(nPos);
}
else
mpInputStream->SetError( SVSTREAM_FILEFORMAT_ERROR );
} }
} }
else else
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment