ofz: timeout

Change-Id: Ia99ce4efe5ad7740f1cae7afcc199bc164b760ca
Reviewed-on: https://gerrit.libreoffice.org/49418Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

emfio/source/reader/emfreader.cxx

@@ -335,30 +335,34 @@ bool ImplReadRegion( tools::PolyPolygon& rPolyPoly, SvStream& rStream, sal_uInt3
     rStream.ReadUInt32(nCount);
     rStream.ReadUInt32(nRgnSize);
 
-    if (   nCount > 0
-        && nType == RDH_RECTANGLES
-        && nLen >= ((nCount << 4) + (nHdSize - 16)))
-    {
-        sal_Int32 nx1, ny1, nx2, ny2;
+    if (!rStream.good() || nCount == 0 || nType != RDH_RECTANGLES)
+        return false;
 
-        for (i = 0; i < nCount; i++)
-        {
-            rStream.ReadInt32(nx1);
-            rStream.ReadInt32(ny1);
-            rStream.ReadInt32(nx2);
-            rStream.ReadInt32(ny2);
-
-            tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
-
-            tools::Polygon aPolygon(aRectangle);
-            tools::PolyPolygon aPolyPolyOr1(aPolygon);
-            tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
-            rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
-            rPolyPoly = aPolyPolyOr2;
-        }
-        return true;
+    sal_uInt32 nSize;
+    if (o3tl::checked_multiply<sal_uInt32>(nCount, 16, nSize))
+        return false;
+    if (o3tl::checked_add<sal_uInt32>(nSize, nHdSize - 16, nSize))
+        return false;
+    if (nLen < nSize)
+        return false;
+
+    sal_Int32 nx1, ny1, nx2, ny2;
+    for (i = 0; i < nCount; i++)
+    {
+        rStream.ReadInt32(nx1);
+        rStream.ReadInt32(ny1);
+        rStream.ReadInt32(nx2);
+        rStream.ReadInt32(ny2);
+
+        tools::Rectangle aRectangle(Point(nx1, ny1), Point(nx2, ny2));
+
+        tools::Polygon aPolygon(aRectangle);
+        tools::PolyPolygon aPolyPolyOr1(aPolygon);
+        tools::PolyPolygon aPolyPolyOr2(rPolyPoly);
+        rPolyPoly.GetUnion(aPolyPolyOr1, aPolyPolyOr2);
+        rPolyPoly = aPolyPolyOr2;
     }
-    return false;
+    return true;
 }
 
 } // anonymous namespace