vcl/source/gdi/dibtools.cxx | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
New commits:
commit 0b350e841db8c4b268cfe1c58ac400a7437ff605
Author: Stephan Bergmann <sberg...@redhat.com>
Date: Thu Jun 19 18:16:11 2014 +0200
Avoid overflow
Change-Id: Iedcde3411a1bfeb1eb0207f572c8befe2071f54c
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index b61a1ad..52708e7 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -17,6 +17,10 @@
* the License at http://www.apache.org/licenses/LICENSE-2.0 .
*/
+#include <sal/config.h>
+
+#include <cassert>
+
#include <vcl/salbtype.hxx>
#include <vcl/dibtools.hxx>
#include <tools/zcodec.hxx>
@@ -240,7 +244,10 @@ bool ImplReadDIBInfoHeader(SvStream& rIStm, DIBV5Header&
rHeader, bool& bTopDown
}
// #144105# protect a little against damaged files
- if( rHeader.nSizeImage > ( 16 * static_cast< sal_uInt32 >( rHeader.nWidth
* rHeader.nHeight ) ) )
+ assert(rHeader.nHeight >= 0);
+ if (rHeader.nHeight != 0 && rHeader.nWidth >= 0
+ && (rHeader.nSizeImage / 16 / static_cast<sal_uInt32>(rHeader.nHeight)
+ > static_cast<sal_uInt32>(rHeader.nWidth)))
{
rHeader.nSizeImage = 0;
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
