lotuswordpro/source/filter/lwpdrawobj.cxx | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
New commits:
commit fb5fe960e4d50176c754ae2d10ce53c3c3da82a1
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Jan 9 16:07:32 2022 +0000
Commit: Michael Stahl <michael.st...@allotropia.de>
CommitDate: Wed Jan 12 11:14:03 2022 +0100
ofz#43446 Undefined-shift
Change-Id: Ibe3485983ecf764ca8b8e667b470c6b210b6d2d4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128192
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
(cherry picked from commit 27e9de358b4afc6a89b09c173316cee0abfb471d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128234
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 6806f68a95dc..7a1f369cb1d8 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1336,6 +1336,22 @@ LwpDrawBitmap::~LwpDrawBitmap()
{
}
+static bool IsValid(const BmpInfoHeader2& rHeader)
+{
+ if (rHeader.nPlanes != 1)
+ return false;
+
+ if (rHeader.nBitCount != 0 && rHeader.nBitCount != 1 &&
+ rHeader.nBitCount != 4 && rHeader.nBitCount != 8 &&
+ rHeader.nBitCount != 16 && rHeader.nBitCount != 24 &&
+ rHeader.nBitCount != 32)
+ {
+ return false;
+ }
+
+ return true;
+}
+
/**
* @descr reading function of class LwpDrawBitmap
*/
@@ -1362,6 +1378,9 @@ void LwpDrawBitmap::Read()
m_pStream->ReadUInt16( aInfoHeader2.nPlanes );
m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
+ if (!IsValid(aInfoHeader2))
+ throw BadRead();
+
N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
if (N == 24)
{
@@ -1378,6 +1397,10 @@ void LwpDrawBitmap::Read()
m_pStream->ReadUInt32( aInfoHeader2.nHeight );
m_pStream->ReadUInt16( aInfoHeader2.nPlanes );
m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
+
+ if (!IsValid(aInfoHeader2))
+ throw BadRead();
+
N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
if (N == 24)
{
