diff options
| author | Luboš Luňák <l.lunak@collabora.com> | 2021-12-06 18:25:55 +0100 |
|---|---|---|
| committer | Luboš Luňák <l.lunak@collabora.com> | 2021-12-06 22:23:18 +0100 |
| commit | f8ffc971545bb54aaebd227fa841f83660dba99c (patch) | |
| tree | e0d44b3de85547946983d9fd78eee11062a00c62 | |
| parent | 70fc728ceef4dcf45dd97dc9051ddb73ff734169 (diff) | |
fix overflow in cairo downscaled bitmap cache (tdf#137719)
In my system, sizeof(long long) == sizeof(long) == 8, so multiplying
by LONG_MAX overflows long long.
Change-Id: Ieb9613ef05916ef24a64db69f698036ecaf194e2
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126456
Tested-by: Jenkins
Reviewed-by: Luboš Luňák <l.lunak@collabora.com>
| -rw-r--r-- | vcl/headless/svpgdi.cxx | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/vcl/headless/svpgdi.cxx b/vcl/headless/svpgdi.cxx index 316349088e9e..ac375c3fadf0 100644 --- a/vcl/headless/svpgdi.cxx +++ b/vcl/headless/svpgdi.cxx @@ -255,7 +255,7 @@ namespace { private: cairo_surface_t* pSurface; - std::unordered_map<unsigned long long, cairo_surface_t*> maDownscaled; + std::unordered_map<sal_uInt64, cairo_surface_t*> maDownscaled; SurfaceHelper(const SurfaceHelper&) = delete; SurfaceHelper& operator=(const SurfaceHelper&) = delete; @@ -302,7 +302,10 @@ namespace nH = (1 == nHFactor) ? nTargetHeight : nH * 2; // check if we have a downscaled version of required size - const unsigned long long key((nW * LONG_MAX) + nH); + // bail out if the multiplication for the key would overflow + if( nW >= SAL_MAX_UINT32 || nH >= SAL_MAX_UINT32 ) + return pSurface; + const sal_uInt64 key((nW * static_cast<sal_uInt64>(SAL_MAX_UINT32)) + nH); auto isHit(maDownscaled.find(key)); if(isHit != maDownscaled.end()) |