vcl/source/filter/ixpm/xpmread.cxx | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
New commits:
commit 10a2388558df957b30136ba32ecc97ddef43fb57
Author: Caolán McNamara <caol...@redhat.com>
Date: Tue Jan 17 12:35:24 2017 +0000
ofz#411: XPMReader::ImplGetColKey short read
Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
Reviewed-on: https://gerrit.libreoffice.org/33217
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Michael Stahl <mst...@redhat.com>
Reviewed-on: https://gerrit.libreoffice.org/33216
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/vcl/source/filter/ixpm/xpmread.cxx
b/vcl/source/filter/ixpm/xpmread.cxx
index a0306b5..6d348eb 100644
--- a/vcl/source/filter/ixpm/xpmread.cxx
+++ b/vcl/source/filter/ixpm/xpmread.cxx
@@ -65,7 +65,7 @@ private:
sal_uLong mnWidth;
sal_uLong mnHeight;
sal_uLong mnColors;
- sal_uLong mnCpp; // characters
per pix
+ sal_uInt32 mnCpp; // characters
per pix
bool mbTransparent;
bool mbStatus;
sal_uLong mnStatus;
@@ -268,6 +268,9 @@ bool XPMReader::ImplGetColor()
if (!ImplGetString())
return false;
+ if (mnStringSize < mnCpp)
+ return false;
+
OString aKey(reinterpret_cast<sal_Char*>(pString), mnCpp);
colordata aValue;
bool bStatus = ImplGetColSub(aValue);
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
