vcl/source/filter/ixpm/xpmread.cxx | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
New commits:
commit caa24065bc0436cde5aa5bd5de4f76c65b1933f0
Author: Caolán McNamara <caol...@redhat.com>
Date: Tue Jan 17 12:35:24 2017 +0000
ofz#411: XPMReader::ImplGetColKey short read
Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
Reviewed-on: https://gerrit.libreoffice.org/33217
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Michael Stahl <mst...@redhat.com>
diff --git a/vcl/source/filter/ixpm/xpmread.cxx
b/vcl/source/filter/ixpm/xpmread.cxx
index 3d22258..6aaaa1c 100644
--- a/vcl/source/filter/ixpm/xpmread.cxx
+++ b/vcl/source/filter/ixpm/xpmread.cxx
@@ -66,7 +66,7 @@ private:
sal_uLong mnWidth;
sal_uLong mnHeight;
sal_uLong mnColors;
- sal_uLong mnCpp; // characters
per pix
+ sal_uInt32 mnCpp; // characters
per pix
bool mbTransparent;
bool mbStatus;
sal_uLong mnStatus;
@@ -305,9 +305,12 @@ bool XPMReader::ImplGetColor( sal_uLong nNumb )
sal_uInt8* pPtr = ( mpColMap + nNumb * ( 4 + mnCpp ) );
bool bStatus = ImplGetString();
- if ( bStatus )
+ if (bStatus && mnStringSize < mnCpp)
+ bStatus = false;
+
+ if (bStatus)
{
- for ( sal_uLong i = 0; i < mnCpp; i++ )
+ for (sal_uInt32 i = 0; i < mnCpp; ++i)
*pPtr++ = *pString++;
bStatus = ImplGetColSub ( pPtr );
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
