gdi32: Check that emf records are within the file.

Signed-off-by: Vincent Povirk <vincent@codeweavers.com> Signed-off-by: Huw Davies <huw@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

gdi32: Check that emf records are within the file.
b6da3547 · Vincent Povirk · Alexandre Julliard · 8d2676fd · b6da3547
Commit b6da3547 authored May 08, 2018 by Vincent Povirk Committed by Alexandre Julliard May 09, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 8 additions and 0 deletions

enhmetafile.c dlls/gdi32/enhmetafile.c +8 -0

No files found.
--- a/dlls/gdi32/enhmetafile.c
+++ b/dlls/gdi32/enhmetafile.c
@@ -2470,6 +2470,14 @@ BOOL WINAPI EnumEnhMetaFile(
    {
 	emr = (ENHMETARECORD *)((char *)emh + offset);
+        if (offset + 8 > emh->nBytes ||
+            offset > offset + emr->nSize ||
+            offset + emr->nSize > emh->nBytes)
+        {
+            WARN("record truncated\n");
+            break;
+        }
        /* In Win9x mode we update the xform if the record will produce output */
        if (hdc && IS_WIN9X() && emr_produces_output(emr->iType))
            EMF_Update_MF_Xform(hdc, info);