diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-01 08:55:58 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-02-01 08:56:31 +0000 |
| commit | 2934b737e9a50febde5a1f681123817bdf8be267 (patch) | |
| tree | 22188e75b4a1aea6e3bc095d7247ec86d604e319 | |
| parent | 55916dfc59f05537c4e6fece77aef3cc1dbef34c (diff) | |
ofz#506 check len before alloc
Change-Id: Ia3a30936fadde10275a964d09150a3b6e4f3e16f
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index 9d9499652b34..3fc16ef9e97c 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -1080,13 +1080,13 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo sal_uInt8 nFlagCounterByte; if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) ) { - if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr ) - return 0xffffffff; - size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8); if (nHeight > pPict->remainingSize() / nByteCountSize) return 0xffffffff; + if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr ) + return 0xffffffff; + std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]); for (sal_uInt16 ny = 0; ny < nHeight; ++ny) { |