1 files changed, 48 insertions, 26 deletions

diff --git a/src/extension/internal/wmf-inout.cpp b/src/extension/internal/wmf-inout.cpp
index 503a93418..f76fa16b4 100644
--- a/src/extension/internal/wmf-inout.cpp
+++ b/src/extension/internal/wmf-inout.cpp
@@ -95,7 +95,6 @@ Wmf::print_document_to_file(SPDocument *doc, const gchar *filename)
     SPPrintContext context;
     const gchar *oldconst;
     gchar *oldoutput;
-    unsigned int ret;
 
     doc->ensureUpToDate();
 
@@ -114,13 +113,12 @@ Wmf::print_document_to_file(SPDocument *doc, const gchar *filename)
     mod->root = mod->base->invoke_show(drawing, mod->dkey, SP_ITEM_SHOW_DISPLAY);
     drawing.setRoot(mod->root);
     /* Print document */
-    ret = mod->begin(doc);
-    if (ret) {
+    if (mod->begin(doc)) {
         g_free(oldoutput);
         throw Inkscape::Extension::Output::save_failed();
     }
     mod->base->invoke_print(&context);
-    ret = mod->finish();
+    mod->finish();
     /* Release arena */
     mod->base->invoke_hide(mod->dkey);
     mod->base = NULL;
@@ -1497,6 +1495,7 @@ int Wmf::myMetaFileProc(const char *contents, unsigned int length, PWMF_CALLBACK
     uint32_t         off=0;
     uint32_t         wmr_mask;
     int              OK =1;
+    int              file_status=1;
     TCHUNK_SPECS     tsp;
     uint8_t          iType;
     int              nSize;   // size of the current record, in bytes, or an error value if <=0
@@ -1562,7 +1561,9 @@ int Wmf::myMetaFileProc(const char *contents, unsigned int length, PWMF_CALLBACK
         U_WMRHEADER Header;
         off = 0;
         nSize = wmfheader_get(contents, blimit, &Placeable, &Header);
-        if(!nSize)return(0);
+        if (!nSize) {
+            return(0);
+        }
         if(!Header.nObjects){  Header.nObjects = 256; }// there _may_ be WMF files with no objects, more likely it is corrupt.  Try to use it anyway.
         d->n_obj     = Header.nObjects;
         d->wmf_obj   = new WMF_OBJECT[d->n_obj];
@@ -1602,7 +1603,10 @@ int Wmf::myMetaFileProc(const char *contents, unsigned int length, PWMF_CALLBACK
                     else {
                         off += nSize;
                     }
-                  }
+                }
+                else {
+                    return(0);
+                }
             }
             off=0;
             nSize = hold_nSize;
@@ -1665,27 +1669,32 @@ int Wmf::myMetaFileProc(const char *contents, unsigned int length, PWMF_CALLBACK
 
 
     while(OK){
-    if(off>=length)return(0);  //normally should exit from while after WMREOF sets OK to false.
+    if (off>=length) {
+        return(0);  //normally should exit from while after WMREOF sets OK to false.
+    }
     contents += nSize;         // pointer to the start of the next record
     off      += nSize;         // offset from beginning of buffer to the start of the next record
 
-    SVGOStringStream tmp_path;
-    SVGOStringStream tmp_str;
-
-    /*  Check that the current record size is OK, abort if not.
-        Pointer math might wrap, so check both sides of the range.
-        Some of the records will reset this with the same value,others will not
-        return a value at this time. */
+    /*  Currently this is a weaker check than for EMF, it only checks the size of the constant part
+        of the record */
     nSize = U_WMRRECSAFE_get(contents, blimit);
-    if(!nSize)break;
+    if(!nSize) {
+        file_status = 0;
+        break;
+    }
 
     iType     = *(uint8_t *)(contents + offsetof(U_METARECORD, iType )  );
 
+    wmr_mask = U_wmr_properties(iType);
+    if (wmr_mask == U_WMR_INVALID) { 
+        file_status = 0;
+        break;
+    }
 //  Uncomment the following to track down toxic records
 // std::cout << "record type: " << (int) iType << " name " << U_wmr_names(iType) << " length: " << nSize << " offset: " << off <<std::endl;
 
-    wmr_mask = U_wmr_properties(iType);
-    if(wmr_mask == U_WMR_INVALID){ throw "Inkscape fatal programming error at U_wmr_properties"; }
+    SVGOStringStream tmp_path;
+    SVGOStringStream tmp_str;
 
 /* Uncomment the following to track down text problems */
 //std::cout << "tri->dirty:"<< d->tri->dirty << " wmr_mask: " << std::hex << wmr_mask << std::dec << std::endl;
@@ -3026,14 +3035,17 @@ std::cout << "BEFORE DRAW"
 // When testing, uncomment the following to place a comment for each processed WMR record in the SVG
 //    d->outsvg += dbg_str.str().c_str();
     d->path   += tmp_path.str().c_str();
-    if(!nSize){ OK=0; std::cout << "nSize == 0, oops!!!" << std::endl; }     // There was some problem with this record, it is not safe to continue
+    if(!nSize){ // There was some problem with the processing of this record, it is not safe to continue
+        file_status = 0;
+        break;
+    } 
 
-    }  //end of while
+    }  //end of while on OK
 // When testing, uncomment the following to show the final SVG derived from the WMF
 // std::cout << d->outsvg << std::endl;
     (void) U_wmr_properties(U_WMR_INVALID);  // force the release of the lookup table memory, returned value is irrelevant
 
-    return 1;
+    return(file_status);
 }
 
 void Wmf::free_wmf_strings(WMF_STRINGS name){
@@ -3049,7 +3061,14 @@ SPDocument *
 Wmf::open( Inkscape::Extension::Input * /*mod*/, const gchar *uri )
 {
 
+    if (uri == NULL) {
+        return NULL;
+    }
+
     WMF_CALLBACK_DATA d;
+    
+    d.n_obj = 0;     //these might not be set otherwise if the input file is corrupt
+    d.wmf_obj=NULL; 
 
     // Default font, WMF spec says device can pick whatever it wants. 
     // WMF files that do not specify a  font are unlikely to look very good!
@@ -3064,12 +3083,12 @@ Wmf::open( Inkscape::Extension::Input * /*mod*/, const gchar *uri )
     d.dc[0].style.stroke_dasharray.set         = 0;
     d.dc[0].style.stroke_linecap.computed      = 2; // U_PS_ENDCAP_SQUARE;
     d.dc[0].style.stroke_linejoin.computed     = 0; // U_PS_JOIN_MITER;
-    d.dc[0].style.stroke_width.value           = 1.0; // will be reset to something reasonable once WMF draying size is known
+    d.dc[0].style.stroke_width.value           = 1.0; // will be reset to something reasonable once WMF drawing size is known
     d.dc[0].style.stroke.value.color.set( 0, 0, 0 );
+    d.dc[0].stroke_set                         = true;
 
-    if (uri == NULL) {
-        return NULL;
-    }
+    // Default brush is none - no fill. WMF files that do not specify a brush are unlikely to look very good!
+    d.dc[0].fill_set                           = false;
 
     d.dc[0].font_name = strdup("Arial"); // Default font, set only on lowest level, it copies up from there WMF spec says device can pick whatever it wants
 
@@ -3095,12 +3114,15 @@ Wmf::open( Inkscape::Extension::Input * /*mod*/, const gchar *uri )
       FT_LOAD_NO_SCALE | FT_LOAD_NO_HINTING  | FT_LOAD_NO_BITMAP,
       FT_KERNING_UNSCALED);
 
-    (void) myMetaFileProc(contents,length, &d);
+    int good = myMetaFileProc(contents,length, &d);
     free(contents);
 
 //    std::cout << "SVG Output: " << std::endl << d.outsvg << std::endl;
 
-    SPDocument *doc = SPDocument::createNewDocFromMem(d.outsvg.c_str(), strlen(d.outsvg.c_str()), TRUE);
+    SPDocument *doc = NULL;
+    if (good) {
+        doc = SPDocument::createNewDocFromMem(d.outsvg.c_str(), strlen(d.outsvg.c_str()), TRUE);
+    }
 
     free_wmf_strings(d.hatches);
     free_wmf_strings(d.images);