[Libreoffice-commits] core.git: 2 commits - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/svm/SvmReader.cxx |    5 +++++
 vcl/source/gdi/metaact.cxx          |    3 +++
 2 files changed, 8 insertions(+)

New commits:
commit 67bb7f71b785d3d831ffaa47262b6cbd84e71c42
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Mar 25 19:56:34 2023 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Mar 25 21:05:51 2023 +0000

    ofz#57134 Timeout
    
    Change-Id: I81cded1dc765d4939a03d46f7df293dfebddcfbe
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149585
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/svm/SvmReader.cxx 
b/vcl/source/filter/svm/SvmReader.cxx
index 6d84d44d879f..5cb9009a5834 100644
--- a/vcl/source/filter/svm/SvmReader.cxx
+++ b/vcl/source/filter/svm/SvmReader.cxx
@@ -818,6 +818,11 @@ rtl::Reference<MetaAction> SvmReader::TextLineHandler()
     mrStream.ReadInt32(nTempWidth);
 
     pAction->SetStartPoint(aPos);
+    if (nTempWidth < 0)
+    {
+        SAL_WARN("vcl.gdi", "negative width");
+        nTempWidth = 0;
+    }
     pAction->SetWidth(nTempWidth);
 
     sal_uInt32 nTempStrikeout(0);
commit c76c805472ff07695d1b1de5e5ed567162c5f227
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Mar 25 19:46:28 2023 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Mar 25 21:05:43 2023 +0000

    ofz#57444 Integer-overflow
    
    Change-Id: I8e18854379c6ad71ebe316d60fbf586cbdc240ae
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149584
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index ad50fa4b2e18..2b8f0809b9fa 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1313,6 +1313,9 @@ MetaHatchAction::MetaHatchAction( tools::PolyPolygon 
aPolyPoly, const Hatch& rHa
 
 void MetaHatchAction::Execute( OutputDevice* pOut )
 {
+    if (!AllowRect(pOut->LogicToPixel(maPolyPoly.GetBoundRect())))
+        return;
+
     pOut->DrawHatch( maPolyPoly, maHatch );
 }