diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2016-12-23 18:44:47 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2016-12-23 19:34:52 +0000 |
| commit | 3cbe00474c373f21b5793915c4919e5c277d2c01 (patch) | |
| tree | 515ac680ca1086bde65a131c3df13c378a7370f4 | |
| parent | 036c1f445a307b464f743b35cda19827ea16d6f8 (diff) | |
Related: ofz#318 limit bitmap max to SAL_MAX_INT32
Change-Id: Iae8a0782e5c306f619e0d94a60dfa0d7c00ec54e
| -rw-r--r-- | vcl/headless/svpbmp.cxx | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx index 10a45967cee0..e7d367a75929 100644 --- a/vcl/headless/svpbmp.cxx +++ b/vcl/headless/svpbmp.cxx @@ -121,9 +121,15 @@ BitmapBuffer* ImplCreateDIB( pDIB->maPalette.SetEntryCount( nColors ); } + size_t size = pDIB->mnScanlineSize * pDIB->mnHeight; + if (size > SAL_MAX_INT32) + { + delete pDIB; + return nullptr; + } + try { - size_t size = pDIB->mnScanlineSize * pDIB->mnHeight; pDIB->mpBits = new sal_uInt8[size]; #ifdef __SANITIZE_ADDRESS__ if (!pDIB->mpBits) |