From 82977c144117d4e601f5f8721e984eaf755469d6 Mon Sep 17 00:00:00 2001
From: Huw Davies <huw@codeweavers.com>
Date: Wed, 26 Jan 2005 19:41:58 +0000
Subject: [PATCH] GetMetaFile checks both the version and the header size when
 it tries to load a metafile.  Powerpoint XP depends on this.

---
 dlls/gdi/metafile.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dlls/gdi/metafile.c b/dlls/gdi/metafile.c
index bd6aa72bff7..ac623b58f87 100644
--- a/dlls/gdi/metafile.c
+++ b/dlls/gdi/metafile.c
@@ -245,6 +245,10 @@ static METAHEADER *MF_ReadMetaFile(HANDLE hfile)
         HeapFree( GetProcessHeap(), 0, mh );
 	return NULL;
     }
+    if(mh->mtVersion != MFVERSION || mh->mtHeaderSize != size / 2) {
+        HeapFree( GetProcessHeap(), 0, mh );
+        return NULL;
+    }
     size = mh->mtSize * 2;
     mh = HeapReAlloc( GetProcessHeap(), 0, mh, size );
     if(!mh) return NULL;