ofz: infinite loop

Change-Id: I00eb3c1d97d27755c8b34676d2fa73a72fc8f9d7
2017-03-15 16:32:43 +00:00
parent 8d18a78e91
commit 68598e06bc
1 changed files with 5 additions and 1 deletions
--- a/vcl/source/gdi/svmconverter.cxx
+++ b/vcl/source/gdi/svmconverter.cxx
@@ -926,7 +926,11 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                        ImplReadUnicodeComment( nUnicodeCommentStreamPos, rIStm, aStr );
                    rMtf.AddAction( new MetaTextAction( aPt, aStr, nIndex, nLen ) );
                }
-                rIStm.Seek( nActBegin + nActionSize );
+
+                if (nActionSize < 24)
+                    rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+                else
+                    rIStm.Seek(nActBegin + nActionSize);
            }
            break;