[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwpdrawobj.cxx |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

New commits:
commit 7c8b41bc322720dc9434fbef1f10a6740913165e
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Jan 13 16:57:48 2022 +0000
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Mon Jan 31 14:30:37 2022 +0100

    ofz#43577 valid reclen must be >= 20
    
    Change-Id: I454bff4acfcd85701a7f094a8bd76898825e9ce2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128388
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 444477a07bcaf59181dbbc719b913566091deadc)
    
    ofz: Use-of-uninitialized-value
    
    Change-Id: I6b768b80d972c5379005efecfb803463ca648b4b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128644
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 7b37a1a5144a3a4c8b0803b7e2da81e9e108bf66)
    
    ofz: Undefined-Shift
    
    Change-Id: Ib935359071ef9e390aa3d6c9713ed48241ad18e6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129066
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit e863b90a0e5fc90c3b824e4b0012f9389b87a3ac)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129183
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx 
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 5de7ae30894d..ce3f5249786d 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1369,14 +1369,21 @@ void LwpDrawBitmap::Read()
     m_pStream->ReadUInt16( m_aBmpRec.nTranslation );
     m_pStream->ReadUInt16( m_aBmpRec.nRotation );
 
+    if (m_aObjHeader.nRecLen < 20)
+        throw BadRead();
+
     // 20 == length of draw-specific fields.
     // 14 == length of bmp file header.
     m_aBmpRec.nFileSize = m_aObjHeader.nRecLen - 20 + 14;
-    m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] );
 
     BmpInfoHeader2 aInfoHeader2;
     m_pStream->ReadUInt32( aInfoHeader2.nHeaderLen );
 
+    if (!m_pStream->good())
+        throw BadRead();
+
+    m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] );
+
     sal_uInt32 N;
     sal_uInt32 rgbTableSize;
 
@@ -1391,7 +1398,7 @@ void LwpDrawBitmap::Read()
             throw BadRead();
 
         N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
-        if (N == 24)
+        if (N >= 16)
         {
             rgbTableSize = 0;
         }
@@ -1411,7 +1418,7 @@ void LwpDrawBitmap::Read()
             throw BadRead();
 
         N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
-        if (N == 24)
+        if (N >= 16)
         {
             rgbTableSize = 0;
         }