[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2016-04-26 Thread Chris Sherlock 
 vcl/qa/cppunit/wmf/wmfimporttest.cxx |   24 
 vcl/source/filter/wmf/enhwmf.cxx |   26 --
 vcl/source/filter/wmf/winmtf.cxx |   12 ++--
 vcl/source/filter/wmf/winwmf.cxx |   11 ---
 4 files changed, 26 insertions(+), 47 deletions(-)

New commits:
commit e21606f3cce557e5eb84b2e7747c173edf526a55
Author: Chris Sherlock 
Date:   Sun Mar 6 12:24:09 2016 +1100

tdf#79679 vcl: dashed lines show as solid lines when importing EMF files

Backported fix to 5.0.

Issue is a regression in commit 09c722873b2d378d2d155f5f1dd7d8f3fb2012e9.
(EMF/WMF: fix rendering of pen styles (dash, dot, dashdot, dashdotdot).

I've looked at how the latest version of Word on the Mac works, and it
turns out that the spacings for the PenStyle enumerations in the LogPen
objects for all the create pen EMF records are as follows:

* PS_DOT   - ■ □ ■ □ ■ □ ■ □ ■ □ ■
* PS_DASHDOT   - ■ ■ ■ □ ■ □ ■ ■ ■ □ ■
* PS_DASHDOTDOT- ■ ■ ■ □ ■ □ ■ □ ■ ■ ■

(where ■ is the actual filled in area, and □ is the space between the
filled in areas)

In other words, each dash fills in the space of three dots, and there
is the one dot worth of empty space between the dashes and dots. Each
"dot" has a width and height equal to the width specified in the pen.

So basically, we seem to be arbitrarily setting the dot, dash and
distance lengths arbitrarily, which were reasonable guesses but tended
to produce very odd lines at different zoom levels.

Change-Id: Ie8b5fa396e4fb0f480cb3594c8129a59f472c1b8
Reviewed-on: https://gerrit.libreoffice.org/22886
Reviewed-by: Chris Sherlock 
Tested-by: Chris Sherlock 
Reviewed-on: https://gerrit.libreoffice.org/22928
Tested-by: Jenkins 
Reviewed-by: Tomaž Vajngerl 
Reviewed-by: Christian Lohmaier 

diff --git a/vcl/qa/cppunit/wmf/wmfimporttest.cxx 
b/vcl/qa/cppunit/wmf/wmfimporttest.cxx
index 32c4d90..176ff5d 100644
--- a/vcl/qa/cppunit/wmf/wmfimporttest.cxx
+++ b/vcl/qa/cppunit/wmf/wmfimporttest.cxx
@@ -146,38 +146,38 @@ void WmfTest::testEmfLineStyles()
 assertXPath(pDoc, "/metafile/linecolor[5]", "color", "#ff");
 
 assertXPath(pDoc, "/metafile/line[1]", "style", "dash");
-assertXPath(pDoc, "/metafile/line[1]", "dashlen", "225");
+assertXPath(pDoc, "/metafile/line[1]", "dashlen", "528");
 assertXPath(pDoc, "/metafile/line[1]", "dashcount", "1");
-assertXPath(pDoc, "/metafile/line[1]", "dotlen", "0");
+assertXPath(pDoc, "/metafile/line[1]", "dotlen", "176");
 assertXPath(pDoc, "/metafile/line[1]", "dotcount", "0");
-assertXPath(pDoc, "/metafile/line[1]", "distance", "100");
+assertXPath(pDoc, "/metafile/line[1]", "distance", "176");
 assertXPath(pDoc, "/metafile/line[1]", "join", "miter");
 assertXPath(pDoc, "/metafile/line[1]", "cap", "butt");
 
 assertXPath(pDoc, "/metafile/line[2]", "style", "dash");
-assertXPath(pDoc, "/metafile/line[2]", "dashlen", "0");
+assertXPath(pDoc, "/metafile/line[2]", "dashlen", "528");
 assertXPath(pDoc, "/metafile/line[2]", "dashcount", "0");
-assertXPath(pDoc, "/metafile/line[2]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[2]", "dotlen", "176");
 assertXPath(pDoc, "/metafile/line[2]", "dotcount", "1");
-assertXPath(pDoc, "/metafile/line[2]", "distance", "50");
+assertXPath(pDoc, "/metafile/line[2]", "distance", "176");
 assertXPath(pDoc, "/metafile/line[2]", "join", "miter");
 assertXPath(pDoc, "/metafile/line[2]", "cap", "butt");
 
 assertXPath(pDoc, "/metafile/line[3]", "style", "dash");
-assertXPath(pDoc, "/metafile/line[3]", "dashlen", "150");
+assertXPath(pDoc, "/metafile/line[3]", "dashlen", "528");
 assertXPath(pDoc, "/metafile/line[3]", "dashcount", "1");
-assertXPath(pDoc, "/metafile/line[3]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[3]", "dotlen", "176");
 assertXPath(pDoc, "/metafile/line[3]", "dotcount", "1");
-assertXPath(pDoc, "/metafile/line[3]", "distance", "90");
+assertXPath(pDoc, "/metafile/line[3]", "distance", "176");
 assertXPath(pDoc, "/metafile/line[3]", "join", "miter");
 assertXPath(pDoc, "/metafile/line[3]", "cap", "butt");
 
 assertXPath(pDoc, "/metafile/line[4]", "style", "dash");
-assertXPath(pDoc, "/metafile/line[4]", "dashlen", "150");
+assertXPath(pDoc, "/metafile/line[4]", "dashlen", "528");
 assertXPath(pDoc, "/metafile/line[4]", "dashcount", "1");
-assertXPath(pDoc, "/metafile/line[4]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[4]", "dotlen", "176");
 assertXPath(pDoc, "/metafile/line[4]", "dotcount", "2");
-

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2016-03-04 Thread Stephan van den Akker 
 vcl/qa/cppunit/wmf/data/line_styles.emf |binary
 vcl/qa/cppunit/wmf/wmfimporttest.cxx|   46 
 vcl/source/filter/wmf/enhwmf.cxx|   36 -
 3 files changed, 70 insertions(+), 12 deletions(-)

New commits:
commit 86b1846bbbd0a7ec84ed9d87fed411910b747765
Author: Stephan van den Akker 
Date:   Tue Feb 23 11:13:20 2016 +0100

Improve the import of pen styles from EMF files

Change-Id: I643c29befeb29b7b1cdd66375f661f4adb0e6cfa
Reviewed-on: https://gerrit.libreoffice.org/22638
Tested-by: Jenkins 
Reviewed-by: David Tardon 
(cherry picked from commit 9db34a7712e277389b2041cfbd77a60476d7f7f1)
Reviewed-on: https://gerrit.libreoffice.org/22718
Reviewed-by: Chris Sherlock 

diff --git a/vcl/qa/cppunit/wmf/data/line_styles.emf 
b/vcl/qa/cppunit/wmf/data/line_styles.emf
new file mode 100644
index 000..07b7832
Binary files /dev/null and b/vcl/qa/cppunit/wmf/data/line_styles.emf differ
diff --git a/vcl/qa/cppunit/wmf/wmfimporttest.cxx 
b/vcl/qa/cppunit/wmf/wmfimporttest.cxx
index 6e595c0..2a1a341 100644
--- a/vcl/qa/cppunit/wmf/wmfimporttest.cxx
+++ b/vcl/qa/cppunit/wmf/wmfimporttest.cxx
@@ -43,6 +43,7 @@ public:
 void testNonPlaceableWmf();
 void testSine();
 void testEmfProblem();
+void testEmfLineStyles();
 void testWorldTransformFontSize();
 void testTdf93750();
 
@@ -50,6 +51,7 @@ public:
 CPPUNIT_TEST(testNonPlaceableWmf);
 CPPUNIT_TEST(testSine);
 CPPUNIT_TEST(testEmfProblem);
+CPPUNIT_TEST(testEmfLineStyles);
 CPPUNIT_TEST(testWorldTransformFontSize);
 CPPUNIT_TEST(testTdf93750);
 
@@ -120,6 +122,50 @@ void WmfTest::testEmfProblem()
 assertXPath(pDoc, "/metafile/sectrectclipregion[1]", "right", "1876");
 }
 
+void WmfTest::testEmfLineStyles()
+{
+SvFileStream aFileStream(getFullUrl("line_styles.emf"), StreamMode::READ);
+GDIMetaFile aGDIMetaFile;
+ReadWindowMetafile(aFileStream, aGDIMetaFile);
+
+MetafileXmlDump dumper;
+dumper.filterAllActionTypes();
+dumper.filterActionType(MetaActionType::LINE, false);
+dumper.filterActionType(MetaActionType::LINECOLOR, false);
+xmlDocPtr pDoc = dumper.dumpAndParse(aGDIMetaFile);
+
+CPPUNIT_ASSERT (pDoc);
+
+assertXPath(pDoc, "/metafile/line", 4);
+assertXPath(pDoc, "/metafile/linecolor", 5);
+
+assertXPath(pDoc, "/metafile/linecolor[1]", "color", "#ff");
+assertXPath(pDoc, "/metafile/linecolor[2]", "color", "#00ff00");
+assertXPath(pDoc, "/metafile/linecolor[3]", "color", "#408080");
+assertXPath(pDoc, "/metafile/linecolor[4]", "color", "#ff");
+assertXPath(pDoc, "/metafile/linecolor[5]", "color", "#ff");
+
+assertXPath(pDoc, "/metafile/line[1]", "style", "dash");
+assertXPath(pDoc, "/metafile/line[1]", "dashlen", "225");
+assertXPath(pDoc, "/metafile/line[1]", "dotlen", "0");
+assertXPath(pDoc, "/metafile/line[1]", "distance", "100");
+
+assertXPath(pDoc, "/metafile/line[2]", "style", "dash");
+assertXPath(pDoc, "/metafile/line[2]", "dashlen", "0");
+assertXPath(pDoc, "/metafile/line[2]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[2]", "distance", "50");
+
+assertXPath(pDoc, "/metafile/line[3]", "style", "dash");
+assertXPath(pDoc, "/metafile/line[3]", "dashlen", "150");
+assertXPath(pDoc, "/metafile/line[3]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[3]", "distance", "90");
+
+assertXPath(pDoc, "/metafile/line[4]", "style", "dash");
+assertXPath(pDoc, "/metafile/line[4]", "dashlen", "150");
+assertXPath(pDoc, "/metafile/line[4]", "dotlen", "30");
+assertXPath(pDoc, "/metafile/line[4]", "distance", "50");
+};
+
 void WmfTest::testWorldTransformFontSize()
 {
 SvFileStream aFileStream(getFullUrl("image1.emf"), StreamMode::READ);
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index f130fad..470e1b2 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -998,20 +998,38 @@ bool EnhWMFReader::ReadEnhWMF()
 aLineInfo.SetWidth( nWidth );
 
 bool bTransparent = false;
-sal_uInt16 nDashCount = 0;
-sal_uInt16 nDotCount = 0;
 
 switch( nStyle & PS_STYLE_MASK )
 {
 case PS_DASHDOTDOT :
-nDotCount++;
+aLineInfo.SetStyle( LINE_DASH );
+aLineInfo.SetDashCount( 1 );
+aLineInfo.SetDotCount( 2 );
+aLineInfo.SetDashLen( 150 );
+aLineInfo.SetDotLen( 30 );
+aLineInfo.SetDistance( 50 );
+break;

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-09-28 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/bitcount-1.wmf |binary
 vcl/source/gdi/dibtools.cxx   |   14 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

New commits:
commit f86ff1a0c164649b06d4721e659c500b0855b79d
Author: Caolán McNamara 
Date:   Mon Sep 28 09:35:23 2015 +0100

wmf spec says that these are only allowed bitcount values

Change-Id: Ia174feec73ee676567a3632d2f88b11c176b6363
(cherry picked from commit b107353addfe35cc40864b7fb5ff4fee42fff6cf)
Reviewed-on: https://gerrit.libreoffice.org/18902
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/bitcount-1.wmf 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/bitcount-1.wmf
new file mode 100644
index 000..2ec8806
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/bitcount-1.wmf differ
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index 4267cce..509d2e4 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -267,7 +267,19 @@ bool ImplReadDIBInfoHeader(SvStream& rIStm, DIBV5Header& 
rHeader, bool& bTopDown
 rHeader.nSizeImage = 0;
 }
 
-return( ( rHeader.nPlanes == 1 ) && ( rIStm.GetError() == 0UL ) );
+
+if (rHeader.nPlanes != 1)
+return false;
+
+if (rHeader.nBitCount != 0 && rHeader.nBitCount != 1 &&
+rHeader.nBitCount != 4 && rHeader.nBitCount != 8 &&
+rHeader.nBitCount != 16 && rHeader.nBitCount != 24 &&
+rHeader.nBitCount != 32)
+{
+return false;
+}
+
+return rIStm.good();
 }
 
 bool ImplReadDIBPalette( SvStream& rIStm, BitmapWriteAccess& rAcc, bool bQuad )
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-09-17 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/jpg/fail/crash-1.jpg |binary
 vcl/source/filter/jpeg/jpegc.cxx   |8 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 3ac6f513458d495a6077068235966a5d627111c2
Author: Caolán McNamara 
Date:   Wed Sep 16 15:10:18 2015 +0100

don't crash with unknown out color space

Change-Id: Ib066ff1fad686d611a86510e768b1109ef7a5e75
(cherry picked from commit 7aa2f8c75d7bda103748fa73766a30fd77e50c16)
Reviewed-on: https://gerrit.libreoffice.org/18640
Reviewed-by: David Tardon 
Tested-by: David Tardon 

diff --git a/vcl/qa/cppunit/graphicfilter/data/jpg/fail/crash-1.jpg 
b/vcl/qa/cppunit/graphicfilter/data/jpg/fail/crash-1.jpg
new file mode 100644
index 000..e783bd3
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/jpg/fail/crash-1.jpg differ
diff --git a/vcl/source/filter/jpeg/jpegc.cxx b/vcl/source/filter/jpeg/jpegc.cxx
index 9762e5a..a9c 100644
--- a/vcl/source/filter/jpeg/jpegc.cxx
+++ b/vcl/source/filter/jpeg/jpegc.cxx
@@ -103,7 +103,13 @@ void ReadJPEG( JPEGReader* pJPEGReader, void* 
pInputStream, long* pLines,
 else if ( cinfo.jpeg_color_space == JCS_YCCK )
 cinfo.out_color_space = JCS_CMYK;
 
-OSL_ASSERT(cinfo.out_color_space == JCS_CMYK || cinfo.out_color_space == 
JCS_GRAYSCALE || cinfo.out_color_space == JCS_RGB);
+if (cinfo.out_color_space != JCS_CMYK &&
+cinfo.out_color_space != JCS_GRAYSCALE &&
+cinfo.out_color_space != JCS_RGB)
+{
+SAL_WARN("vcl.filter", "jpg with unknown out color space, forcing to 
rgb");
+cinfo.out_color_space = JCS_RGB;
+}
 
 /* change scale for preview import */
 long nPreviewWidth = previewSize.Width();
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-09-01 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf |binary
 vcl/source/filter/wmf/winwmf.cxx  |2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 03d15f2728be8d0e0e226dacdaf0bee8340b0ecd
Author: Caolán McNamara 
Date:   Mon Aug 31 15:06:27 2015 +0100

check stream status

Change-Id: I27bb289288d319a93201e9c3d703114924ca258c
(cherry picked from commit daf1578d752531e2b48d183531d9a4a7cedfc37e)
Reviewed-on: https://gerrit.libreoffice.org/18177
Reviewed-by: Jan Holesovsky 
Tested-by: Jan Holesovsky 

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf
new file mode 100644
index 000..f16b60c
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 7c153c7..1f4cd7d 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -650,7 +650,7 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
 pAcc = aBmp.AcquireWriteAccess();
 if ( pAcc )
 {
-for (sal_uInt16 y = 0; y < nHeight; y++ )
+for (sal_uInt16 y = 0; y < nHeight && pWMF->good(); ++y)
 {
 sal_uInt16 x = 0;
 for (sal_uInt16 scan = 0; scan < nBytesPerScan; scan++ 
)
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-08-28 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf |binary
 vcl/source/filter/wmf/enhwmf.cxx  |   19 +-
 2 files changed, 14 insertions(+), 5 deletions(-)

New commits:
commit e28af9d5cc430244631aeceed290ffe7484f6a1d
Author: Caolán McNamara caol...@redhat.com
Date:   Thu Aug 27 20:20:01 2015 +0100

don't loop on overly-short nEndPos

Change-Id: I60d3388ece28a69c31a85b9e3b495cbe8a03e7dc
(cherry picked from commit 42732d255423700461f4abadfed77d89efa9cdd0)
Reviewed-on: https://gerrit.libreoffice.org/18097
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf
new file mode 100644
index 000..80ad795
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 7f7bf81..87d492d6 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -617,7 +617,7 @@ void EnhWMFReader::ReadAndDrawPolyPolygon()
 bool EnhWMFReader::ReadEnhWMF()
 {
 sal_uInt32  nStretchBltMode = 0;
-sal_uInt32  nRecType(0), nRecSize(0), nNextPos(0),
+sal_uInt32  nNextPos(0),
 nW(0), nH(0), nColor(0), nIndex(0),
 nDat32(0), nNom1(0), nDen1(0), nNom2(0), nDen2(0);
 sal_Int32   nX32(0), nY32(0), nx32(0), ny32(0);
@@ -629,7 +629,8 @@ bool EnhWMFReader::ReadEnhWMF()
 
 while( bStatus  nRecordCount--  pWMF-good())
 {
-pWMF-ReadUInt32( nRecType ).ReadUInt32( nRecSize );
+sal_uInt32  nRecType(0), nRecSize(0);
+pWMF-ReadUInt32(nRecType).ReadUInt32(nRecSize);
 
 if ( !pWMF-good() || ( nRecSize  8 ) || ( nRecSize  3 ) ) // 
Parameters are always divisible by 4
 {
@@ -637,14 +638,22 @@ bool EnhWMFReader::ReadEnhWMF()
 break;
 }
 
-const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF-Tell() + 8;
+auto nCurPos = pWMF-Tell();
+
+if (nEndPos  nCurPos - 8)
+{
+bStatus = false;
+break;
+}
+
+const sal_uInt32 nMaxPossibleRecSize = nEndPos - (nCurPos - 8);
 if (nRecSize  nMaxPossibleRecSize)
 {
 bStatus = false;
 break;
 }
 
-nNextPos = pWMF-Tell() + ( nRecSize - 8 );
+nNextPos = nCurPos + (nRecSize - 8);
 
 if(  !aBmpSaveList.empty()
( nRecType != EMR_STRETCHBLT )
@@ -1423,7 +1432,7 @@ bool EnhWMFReader::ReadEnhWMF()
 case EMR_EXTTEXTOUTW :
 {
 sal_Int32   nLeft, nTop, nRight, nBottom, ptlReferenceX, 
ptlReferenceY, nGfxMode, nXScale, nYScale;
-sal_uInt32  nCurPos, nOffString, nOptions, offDx;
+sal_uInt32  nOffString, nOptions, offDx;
 sal_Int32   nLen;
 std::vectorlong aDX;
 
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-08-15 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx   |   33 +++--
 2 files changed, 15 insertions(+), 18 deletions(-)

New commits:
commit fdc60b7497439e25a1b30d259f3407aeff8e3236
Author: Caolán McNamara caol...@redhat.com
Date:   Fri Aug 14 09:25:32 2015 +0100

limit access to dx array to min of input len and len of array

i.e. the sal_Int32 nDXLen = std::minsal_Int32(nLen, aOldDX.size()); line
and its usage

Change-Id: Ib0100d2de210a45b340c3a7de6c6dcf2a07443d0
(cherry picked from commit 6d4f97b05b1bfe5aae395134b2dc35805c23b8c4)
Reviewed-on: https://gerrit.libreoffice.org/17751
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: Norbert Thiebaud nthieb...@gmail.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf
new file mode 100644
index 000..a522132
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-2.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 8b92f54..7f7bf81 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1425,7 +1425,7 @@ bool EnhWMFReader::ReadEnhWMF()
 sal_Int32   nLeft, nTop, nRight, nBottom, ptlReferenceX, 
ptlReferenceY, nGfxMode, nXScale, nYScale;
 sal_uInt32  nCurPos, nOffString, nOptions, offDx;
 sal_Int32   nLen;
-long* pDX = NULL;
+std::vectorlong aDX;
 
 nCurPos = pWMF-Tell() - 8;
 
@@ -1451,13 +1451,12 @@ bool EnhWMFReader::ReadEnhWMF()
 pWMF-Seek( nCurPos + offDx );
 if ( ( nLen * sizeof(sal_uInt32) ) = ( nEndPos - 
pWMF-Tell() ) )
 {
-pDX = new long[ nLen ];
-sal_Int32 i;
-sal_Int32 val;
-for ( i = 0; i  nLen; i++ )
+aDX.resize(nLen);
+for (sal_Int32 i = 0; i  nLen; ++i)
 {
-pWMF-ReadInt32( val );
-pDX[ i ] = val;
+sal_Int32 val(0);
+pWMF-ReadInt32(val);
+aDX[i] = val;
 }
 }
 }
@@ -1469,23 +1468,22 @@ bool EnhWMFReader::ReadEnhWMF()
 {
 boost::scoped_arraysal_Char pBuf(new 
sal_Char[ nLen ]);
 pWMF-Read( pBuf.get(), nLen );
-aText = OUString( pBuf.get(), 
(sal_uInt16)nLen, pOut-GetCharSet() );
+aText = OUString(pBuf.get(), nLen, 
pOut-GetCharSet());
 pBuf.reset();
 
 if ( aText.getLength() != nLen )
 {
-sal_uInt16 i, j;
-long* pOldDx = pDX;
-pDX = new long[ aText.getLength() ];
-for ( i = 0, j = 0; i  aText.getLength(); 
i++ )
+std::vectorlong 
aOldDX(aText.getLength());
+aOldDX.swap(aDX);
+sal_Int32 nDXLen = 
std::minsal_Int32(nLen, aOldDX.size());
+for (sal_Int32 i = 0, j = 0; i  
aText.getLength(); ++i)
 {
 sal_Unicode cUniChar = aText[i];
 OString aCharacter(cUniChar, 1, 
pOut-GetCharSet());
-pDX[ i ] = 0;
-for (sal_Int32 k = 0; ( k  
aCharacter.getLength() )  ( j  nLen )  ( i  aText.getLength() ); ++k)
-pDX[ i ] += pOldDx[ j++ ];
+aDX[i] = 0;
+for (sal_Int32 k = 0; ( k  
aCharacter.getLength() )  ( j  nDXLen )  ( i  aText.getLength() ); ++k)
+aDX[ i ] += aOldDX[j++];
 }
-delete[] pOldDx;
 }
 }
 }
@@ -1507,9 +1505,8 @@ bool EnhWMFReader::ReadEnhWMF()
 aText = OUString(pBuf.get(), nLen);
 }
 }
-pOut-DrawText( aPos, aText, pDX,

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-08-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf |binary
 vcl/source/filter/wmf/enhwmf.cxx  |7 ---
 2 files changed, 4 insertions(+), 3 deletions(-)

New commits:
commit aff9057c35827ec7a6219b1c752f7525db64cdca
Author: Caolán McNamara caol...@redhat.com
Date:   Wed Aug 12 16:30:21 2015 +0100

another avoid endless loop with busted wmf

Change-Id: Ie4068fdc1e54e0ad3e55354938a4c5e1459e7fe0
(cherry picked from commit 7ffe6aebb44ed3f7b5fd1ffe3ccfccf0f61984b3)
Reviewed-on: https://gerrit.libreoffice.org/17682
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf
new file mode 100644
index 000..f8f1538
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-2.wmf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index c20ab5f..8b92f54 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -637,14 +637,15 @@ bool EnhWMFReader::ReadEnhWMF()
 break;
 }
 
-nNextPos = pWMF-Tell() + ( nRecSize - 8 );
-
-if ( !pWMF-good() || nNextPos  nEndPos )
+const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF-Tell() + 8;
+if (nRecSize  nMaxPossibleRecSize)
 {
 bStatus = false;
 break;
 }
 
+nNextPos = pWMF-Tell() + ( nRecSize - 8 );
+
 if(  !aBmpSaveList.empty()
( nRecType != EMR_STRETCHBLT )
( nRecType != EMR_STRETCHDIBITS )
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-14 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-3.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx   |4 +++-
 2 files changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 729ba6999667fea9bc4ee6966f63368726a290f5
Author: Caolán McNamara caol...@redhat.com
Date:   Mon Jul 13 20:44:16 2015 +0100

fix a third emf crash

Change-Id: I3b5d0daf05e3272d2afa0da84ff0b1f8d5c965a4
(cherry picked from commit 173fd90387e8bb7f33c2608628f12c7f772f0277)
Reviewed-on: https://gerrit.libreoffice.org/17022
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-3.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-3.emf
new file mode 100644
index 000..92da5f0
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-3.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index dcd802c..c20ab5f 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1441,7 +1441,9 @@ bool EnhWMFReader::ReadEnhWMF()
 DBG_ASSERT( ( nOptions  ( ETO_PDY | ETO_GLYPH_INDEX ) ) 
== 0, SJ: ETO_PDY || ETO_GLYPH_INDEX in EMF );
 
 Point aPos( ptlReferenceX, ptlReferenceY );
-if ( nLen  0  nLen  static_castsal_Int32( 
SAL_MAX_UINT32 / sizeof(sal_Int32) ) )
+bool bLenSane = nLen  0  nLen  static_castsal_Int32( 
SAL_MAX_UINT32 / sizeof(sal_Int32) );
+bool bOffStringSane = nOffString = nEndPos - nCurPos;
+if (bLenSane  bOffStringSane)
 {
 if ( offDx  (( nCurPos + offDx + nLen * 4 ) = 
nNextPos ) )
 {
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx   |2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 31880a0c0123f2062bd39a2d0aa928561fa1fc05
Author: Caolán McNamara caol...@redhat.com
Date:   Sun Jul 12 21:07:21 2015 +0100

emf: test for negative numbers

Change-Id: I9d9b6f3e9592ca7b85cee5422e43d4ca46b8bb36
(cherry picked from commit 4661b2dd34bd7c56b6d783d49f265e9ecde19caa)
Reviewed-on: https://gerrit.libreoffice.org/16969
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf
new file mode 100644
index 000..bbc0285
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/pass/crash-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 840f958..dcd802c 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1441,7 +1441,7 @@ bool EnhWMFReader::ReadEnhWMF()
 DBG_ASSERT( ( nOptions  ( ETO_PDY | ETO_GLYPH_INDEX ) ) 
== 0, SJ: ETO_PDY || ETO_GLYPH_INDEX in EMF );
 
 Point aPos( ptlReferenceX, ptlReferenceY );
-if ( nLen  nLen  static_castsal_Int32( SAL_MAX_UINT32 
/ sizeof(sal_Int32) ) )
+if ( nLen  0  nLen  static_castsal_Int32( 
SAL_MAX_UINT32 / sizeof(sal_Int32) ) )
 {
 if ( offDx  (( nCurPos + offDx + nLen * 4 ) = 
nNextPos ) )
 {
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx  |2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

New commits:
commit bcf9f7c7e06ee97106b5a555a97599e6b0ed1c13
Author: Caolán McNamara caol...@redhat.com
Date:   Mon Jul 13 09:10:12 2015 +0100

emf: fix hang

Change-Id: I2410308ecccb8c5318a718bafadc7b40a98cb82b
(cherry picked from commit 8695633023cc321a095753db98bdc69d2aeee058)
Reviewed-on: https://gerrit.libreoffice.org/16976
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf
new file mode 100644
index 000..634fccd
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-1.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index f02871d..de78559 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -663,7 +663,7 @@ bool EnhWMFReader::ReadEnhWMF()
 
 SAL_INFO(vcl.emf, \tGDI comment, length:   length);
 
-if( pWMF-good()  length = 4 ) {
+if( pWMF-good()  length = 4  length = pWMF-remainingSize() 
) {
 sal_uInt32 id;
 
 pWMF-ReadUInt32( id );
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-2.emf |binary
 vcl/source/filter/wmf/winmtf.cxx   |   26 +
 2 files changed, 15 insertions(+), 11 deletions(-)

New commits:
commit 1eb5b896c366e270d5a09918b9f857ee90b37ad7
Author: Caolán McNamara caol...@redhat.com
Date:   Mon Jul 13 08:33:50 2015 +0100

emf: test for empty polygons

Change-Id: I3c8896230e3d48a37f4b8d702b0f673e44f45ba4
(cherry picked from commit 7df4d8544c6b12e31bcb81d9389d03ae7c11bfea)
Reviewed-on: https://gerrit.libreoffice.org/16973
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-2.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-2.emf
new file mode 100644
index 000..6adabec
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/crash-2.emf differ
diff --git a/vcl/source/filter/wmf/winmtf.cxx b/vcl/source/filter/wmf/winmtf.cxx
index f14f934..20e2b5c 100644
--- a/vcl/source/filter/wmf/winmtf.cxx
+++ b/vcl/source/filter/wmf/winmtf.cxx
@@ -1294,18 +1294,22 @@ void WinMtfOutput::DrawPolyLine( Polygon rPolygon, 
bool bTo, bool bRecordPath )
 {
 UpdateClipRegion();
 
-ImplMap( rPolygon );
-if ( bTo )
-{
-rPolygon[ 0 ] = maActPos;
-maActPos = rPolygon[ rPolygon.GetSize() - 1 ];
-}
-if ( bRecordPath )
-aPathObj.AddPolyLine( rPolygon );
-else
+sal_uInt16 nPoints = rPolygon.GetSize();
+if (nPoints = 1)
 {
-UpdateLineStyle();
-mpGDIMetaFile-AddAction( new MetaPolyLineAction( rPolygon, 
maLineStyle.aLineInfo ) );
+ImplMap( rPolygon );
+if ( bTo )
+{
+rPolygon[ 0 ] = maActPos;
+maActPos = rPolygon[ rPolygon.GetSize() - 1 ];
+}
+if ( bRecordPath )
+aPathObj.AddPolyLine( rPolygon );
+else
+{
+UpdateLineStyle();
+mpGDIMetaFile-AddAction( new MetaPolyLineAction( rPolygon, 
maLineStyle.aLineInfo ) );
+}
 }
 }
 
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-2.emf |binary
 vcl/source/filter/wmf/enhwmf.cxx  |4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 5966b7cc69123da2c267917f5e82a5b1c6985aaf
Author: Caolán McNamara caol...@redhat.com
Date:   Mon Jul 13 09:45:55 2015 +0100

emf: fix another hang

Change-Id: I971ba5f422827f3b8fcdb86c447fc48415225eca
(cherry picked from commit fe20502c86ef6156a54bb37ba2560c8b64d129a4)
Reviewed-on: https://gerrit.libreoffice.org/16978
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-2.emf 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-2.emf
new file mode 100644
index 000..e3baf3b
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/emf/fail/hang-2.emf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index de78559..840f958 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -1728,9 +1728,9 @@ bool EnhWMFReader::ReadHeader()
 
 pWMF-ReadInt32(nRecordCount);
 
-if (nRecordCount == 0)
+if (nRecordCount = 0)
 {
-SAL_WARN(vcl.emf, EMF\t\tEMF Header object shows record counter as 
0! This shouldn't 
+SAL_WARN(vcl.emf, EMF\t\tEMF Header object shows record counter as 
= 0! This shouldn't 
 be possible... indicator of possible file 
corruption?);
 return false;
 }
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif |binary
 vcl/source/filter/igif/decode.cxx  |2 ++
 2 files changed, 2 insertions(+)

New commits:
commit bca56c8bc261cd52969fc7e05d6bd2ed9ef72ea6
Author: Caolán McNamara caol...@redhat.com
Date:   Sat Jul 11 15:31:19 2015 +0100

fix gif import crash

Change-Id: I3a5e0efef6843fb8f8b485fa2369ac5b99513c31
(cherry picked from commit 839e051c658a638a259be6a6bb091b654fac405f)
Reviewed-on: https://gerrit.libreoffice.org/16952
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif 
b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif
new file mode 100644
index 000..860f9e1
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx 
b/vcl/source/filter/igif/decode.cxx
index 105eab9..2b445e9 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -200,6 +200,8 @@ bool GIFLZWDecompressor::ProcessOneCode()
 pE = pTable + nCode;
 do
 {
+if (pOutBufData == pOutBuf) //can't go back past start
+return false;
 nOutBufDataLen++;
 *(--pOutBufData) = pE-nData;
 pE = pE-pPrev;
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif |binary
 vcl/source/filter/igif/decode.cxx  |3 +++
 2 files changed, 3 insertions(+)

New commits:
commit b657d6c484ed75f7db4497c720caaffcc519b88c
Author: Caolán McNamara caol...@redhat.com
Date:   Sun Jul 12 10:56:48 2015 +0100

fix another gif import crash

Change-Id: I0ffa569e0c4240e11184df7dd56b95d87a12425d
(cherry picked from commit ee35b72064d8d1333709b102b051360018f8044b)
Reviewed-on: https://gerrit.libreoffice.org/16961
Tested-by: Jenkins c...@libreoffice.org
Reviewed-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif 
b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif
new file mode 100644
index 000..b7265f8
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx 
b/vcl/source/filter/igif/decode.cxx
index 46a666f..105eab9 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -193,6 +193,9 @@ bool GIFLZWDecompressor::ProcessOneCode()
 
 nOldCode = nCode;
 
+if (nCode  4096)
+return false;
+
 // write character(/-sequence) of code nCode in the output buffer:
 pE = pTable + nCode;
 do
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-13 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/xbm/fail/crash-1.xbm |   12 
 vcl/qa/cppunit/graphicfilter/data/xbm/pass/grafix4.xbm | 2011 +
 vcl/qa/cppunit/graphicfilter/filters-test.cxx  |4 
 vcl/source/filter/ixbm/xbmread.cxx |2 
 4 files changed, 2028 insertions(+), 1 deletion(-)

New commits:
commit 2799db6d3ee548cce639d6c717ed80387852fec0
Author: Caolán McNamara caol...@redhat.com
Date:   Sat Jul 11 17:23:06 2015 +0100

fix and test for xbm import crash

Change-Id: I47e7cb259908ffc6a00475369af1a841acda1da7
(cherry picked from commit 7eb693f87b6a01044999564cce0a18fefca11c99)
Reviewed-on: https://gerrit.libreoffice.org/16953
Reviewed-by: David Tardon dtar...@redhat.com
Tested-by: David Tardon dtar...@redhat.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/xbm/fail/.gitignore 
b/vcl/qa/cppunit/graphicfilter/data/xbm/fail/.gitignore
new file mode 100644
index 000..e69de29
diff --git a/vcl/qa/cppunit/graphicfilter/data/xbm/fail/crash-1.xbm 
b/vcl/qa/cppunit/graphicfilter/data/xbm/fail/crash-1.xbm
new file mode 100644
index 000..9d2a434
--- /dev/null
+++ b/vcl/qa/cppunit/graphicfilter/data/xbm/fail/crash-1.xbm
@@ -0,0 +1,12 @@
+#define?te_width 31
+#define te_height = {
+   0x0e, 0x20, 0x02, 0x38, 0x11, 0x70, 0x07, 0x 0x44,
+   0x11, 1x2e, 0x3a, 0x44, 0x8e, 0x24, 0x92, 0x38, 0xdf, 0x25, 0xd2,0x7d,
+   0x91, 0x24 0x92, 0x44, 0x95: 0x24, 0x92, 0x54, 0xf5, 0x7f, 0xff, 0x57,
+   0x95, 0x24, 0x92, 0x54, 0x95, 0x 4,54, 0x95, 0x24, 0x92, 0x54,
+   0x95, 0x24,x54, 0x95, 0x24, 0x92, 0x54, 0x95, 0x24, 0x92, 0x54,
+   0x95, 0x24, 0x92, 0x54, 0x95, 0x24, 0x92,0x54, 0x95, 0x24, 0x92, 0x54,
+   0x95, 0x24,ÏÏÏ 0x92, 0x54, 0x95, 0x24, 0x92, 0x54, 0xf5, 0x7f, 0xff, 
0x57,
+   0x95,0x24, 0x92, 0x54, 0x95, 0x24, 0x92, 0x54, 0, 0x54, 0xf5, 0xd= {
+ 25, 0xd2, 0x7d,
+0x00, 0x7c };
\ No newline at end of file
diff --git a/vcl/qa/cppunit/graphicfilter/data/xbm/indeterminate/.gitignore 
b/vcl/qa/cppunit/graphicfilter/data/xbm/indeterminate/.gitignore
new file mode 100644
index 000..e69de29
diff --git a/vcl/qa/cppunit/graphicfilter/data/xbm/pass/.gitignore 
b/vcl/qa/cppunit/graphicfilter/data/xbm/pass/.gitignore
new file mode 100644
index 000..e69de29
diff --git a/vcl/qa/cppunit/graphicfilter/data/xbm/pass/grafix4.xbm 
b/vcl/qa/cppunit/graphicfilter/data/xbm/pass/grafix4.xbm
new file mode 100755
index 000..aad9f03
--- /dev/null
+++ b/vcl/qa/cppunit/graphicfilter/data/xbm/pass/grafix4.xbm
@@ -0,0 +1,2011 @@
+#define Grafix1_width 485
+#define Grafix1_height 395
+static char Grafix1_bits[] = {
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0xc0, 0x01, 0x00, 0x00,

[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

2015-07-10 Thread Caolán McNamara 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf |binary
 vcl/source/filter/wmf/winwmf.cxx  |   10 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 55486cf648813bc0c46eaf0df2f0544a5d57ccb2
Author: Caolán McNamara caol...@redhat.com
Date:   Fri Jul 10 08:40:42 2015 +0100

avoid endless loop with busted wmf

Change-Id: I104de360f2e861e959ad2dad434a768440877f6f
(cherry picked from commit fd2749455fe25e24b448a44f9ada6113e5ac0d13)
Reviewed-on: https://gerrit.libreoffice.org/16914
Reviewed-by: Michael Meeks michael.me...@collabora.com
Tested-by: Michael Meeks michael.me...@collabora.com

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf
new file mode 100644
index 000..7ba05cb
Binary files /dev/null and 
b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-1.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index c7d1315..5e25949 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1394,9 +1394,13 @@ void WMFReader::ReadWMF()
 }
 }
 }
-nPos += nRecSize * 2;
-if ( nPos = nEndPos )
-pWMF-Seek( nPos  );
+const sal_uInt32 nAvailableBytes = nEndPos - nPos;
+const sal_uInt32 nMaxPossibleRecordSize = nAvailableBytes/2;
+if (nRecSize = nMaxPossibleRecordSize)
+{
+nPos += nRecSize * 2;
+pWMF-Seek(nPos);
+}
 else
 pWMF-SetError( SVSTREAM_FILEFORMAT_ERROR );
 }
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits