filter/source/graphicfilter/ipcx/ipcx.cxx | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
New commits:
commit 369018cffb6d1c77e2fb4feec6a4df8a27872ec5
Author: Caolán McNamara <caol...@redhat.com>
Date: Wed Feb 14 15:11:06 2018 +0000
ofz#6330 Out-of-memory
Change-Id: Ie138705e7994915d7824d8cf1ae1a0e17e247256
Reviewed-on: https://gerrit.libreoffice.org/49740
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/graphicfilter/ipcx/ipcx.cxx
b/filter/source/graphicfilter/ipcx/ipcx.cxx
index c06a5159ec5e..51b50be2fa56 100644
--- a/filter/source/graphicfilter/ipcx/ipcx.cxx
+++ b/filter/source/graphicfilter/ipcx/ipcx.cxx
@@ -40,7 +40,7 @@ private:
sal_uLong nPlanes; // no of planes
sal_uLong nBytesPerPlaneLin; // bytes per plane line
- sal_uLong nWidth, nHeight; // dimension in pixel
+ sal_uInt32 nWidth, nHeight; // dimension in pixel
sal_uInt16 nResX, nResY; // resolution in pixel per inch or
0,0
sal_uInt16 nDestBitsPerPixel; // bits per pixel in destination
bitmap 1,4,8 or 24
std::unique_ptr<sal_uInt8[]>
@@ -96,6 +96,12 @@ bool PCXReader::ReadPCX(Graphic & rGraphic)
bStatus = false;
}
+ if (bStatus)
+ {
+ sal_uInt32 nResult;
+ bStatus = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult
<= SAL_MAX_INT32/2/3;
+ }
+
// Write BMP header and conditionally (maybe invalid for now) color
palette:
if (bStatus)
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
