basebmp/source/bitmapdevice.cxx | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
New commits:
commit 8e01c3fc925b714f4b77ca9c51d7a9973276f577
Author: Caolán McNamara <caol...@redhat.com>
Date: Thu Aug 28 09:23:03 2014 +0100
keep nScanlineStride number sane
bff + valgrind
Change-Id: I255a052251a6a0f1e4005b9cfb3b6ce00c6653ee
(cherry picked from commit 35412949a2fb2a4472177a0289de4f0c062b674d)
Reviewed-on: https://gerrit.libreoffice.org/11163
Reviewed-by: Eike Rathke <er...@redhat.com>
Tested-by: Eike Rathke <er...@redhat.com>
diff --git a/basebmp/source/bitmapdevice.cxx b/basebmp/source/bitmapdevice.cxx
index 4b86231..cdd3d5f 100644
--- a/basebmp/source/bitmapdevice.cxx
+++ b/basebmp/source/bitmapdevice.cxx
@@ -1946,12 +1946,15 @@ BitmapDeviceSharedPtr createBitmapDeviceImplInner(
const basegfx::B2IVector&
nScanlineFormat > FORMAT_MAX )
return BitmapDeviceSharedPtr();
-
-
- sal_Int32 nScanlineStride(0);
-
+ sal_uInt8 nBitsPerPixel = bitsPerPixel[nScanlineFormat];
+ if (rSize.getX() > (SAL_MAX_INT32-7) / nBitsPerPixel)
+ {
+ SAL_WARN("basebmp", "suspicious bitmap width " <<
+ rSize.getX() << " for depth " << nBitsPerPixel);
+ return BitmapDeviceSharedPtr();
+ }
// round up to full 8 bit, divide by 8
- nScanlineStride = (rSize.getX()*bitsPerPixel[nScanlineFormat] + 7) >> 3;
+ sal_Int32 nScanlineStride = (rSize.getX()*nBitsPerPixel + 7) >> 3;
// rounded up to next full power-of-two number of bytes
const sal_uInt32 bytesPerPixel = nextPow2(
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
