[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/imet/ios2met.cxx |   17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

New commits:
commit d606853593a737c28c23a8a9cd47c00dcc17d517
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Dec 2 14:13:14 2021 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Dec 2 22:52:21 2021 +0100

    ofz#41591 reject incomplete polygon records
    
    Change-Id: I4761c2ae76463ad2441abf2599b69f35dc572a5c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126249
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/imet/ios2met.cxx 
b/vcl/source/filter/imet/ios2met.cxx
index e762785f4d4c..992a6c5d5e60 100644
--- a/vcl/source/filter/imet/ios2met.cxx
+++ b/vcl/source/filter/imet/ios2met.cxx
@@ -1375,17 +1375,26 @@ void OS2METReader::ReadFillet(bool bGivenPos, 
sal_uInt16 nOrderLen)
 
 void OS2METReader::ReadFilletSharp(bool bGivenPos, sal_uInt16 nOrderLen)
 {
-    sal_uInt16 i,nNumPoints;
-
     if (bGivenPos) {
         aAttr.aCurPos=ReadPoint();
         if (bCoord32) nOrderLen-=8; else nOrderLen-=4;
     }
+
+    sal_uInt16 nNumPoints;
     if (bCoord32) nNumPoints=1+nOrderLen/10;
     else nNumPoints=1+nOrderLen/6;
+
     tools::Polygon aPolygon(nNumPoints);
-    aPolygon.SetPoint(aAttr.aCurPos,0);
-    for (i=1; i<nNumPoints; i++) aPolygon.SetPoint(ReadPoint(),i);
+    aPolygon.SetPoint(aAttr.aCurPos, 0);
+    for (sal_uInt16 i = 1; i <nNumPoints; ++i)
+        aPolygon.SetPoint(ReadPoint(), i);
+
+    if (!pOS2MET->good())
+    {
+        SAL_WARN("filter.os2met", "OS2METReader::ReadFilletSharp: short read");
+        return;
+    }
+
     aAttr.aCurPos=aPolygon.GetPoint(nNumPoints-1);
     if (pAreaStack!=nullptr) AddPointsToArea(aPolygon);
     else if (pPathStack!=nullptr) AddPointsToPath(aPolygon);