diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-17 21:16:34 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-06-27 13:58:02 +0200 |
| commit | f14e2ad6e0afea83f01f2de89f574a2f01aec288 (patch) | |
| tree | 91c6e6b2443f0fec7fb2550a640c2969b37fec2e | |
| parent | 4158828a469093f4f0a2fbcb1c2fd733934ddffe (diff) | |
ofz#2287 check multiply
Change-Id: Ibc4c93ac1f5686a476b5e303347dc951daa58e33
Reviewed-on: https://gerrit.libreoffice.org/38911
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Eike Rathke <erack@redhat.com>
(cherry picked from commit 67caad3c98d045b8de3e4bf2f63efda2e9d8cc48)
| -rw-r--r-- | vcl/headless/svpbmp.cxx | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx index 71c5e52586c6..02aa41b66bc5 100644 --- a/vcl/headless/svpbmp.cxx +++ b/vcl/headless/svpbmp.cxx @@ -135,7 +135,15 @@ BitmapBuffer* ImplCreateDIB( try { - size_t size = pDIB->mnScanlineSize * pDIB->mnHeight; + size_t size; + bFail = o3tl::checked_multiply<size_t>(pDIB->mnHeight, pDIB->mnScanlineSize, size); + SAL_WARN_IF(bFail, "vcl.gdi", "checked multiply failed"); + if (bFail) + { + delete pDIB; + return nullptr; + } + pDIB->mpBits = new sal_uInt8[size]; #ifdef __SANITIZE_ADDRESS__ if (!pDIB->mpBits) |