diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-11-24 10:45:44 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-11-24 16:35:57 +0000 |
| commit | 5eb4ccb005f86717f886e5bc0079c739904eec61 (patch) | |
| tree | efac283483e4d8f59c1368c27a4b0e54db3c7412 | |
| parent | a5f9e77e98b63ccf2be01d9850be122e9742b157 (diff) | |
coverity#1242658 Untrusted loop bound
Change-Id: Ie22cb785065342582ca59f871a7b4da7e7bc77e5
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index acef0b77ce3e..38e7cde58b09 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -906,7 +906,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo sal_uInt16 nByteCount, nCount, nD; sal_uLong nSrcBitsPos; - if ( nRowBytes < 2 * nWidth ) + if (nWidth > nRowBytes / 2) BITMAPERROR; size_t nMinRecordSize; @@ -921,6 +921,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo const size_t nMaxRows = pPict->remainingSize() / nMinRowWidth; if (nHeight > nMaxRows) BITMAPERROR; + const size_t nMaxCols = pPict->remainingSize() / nHeight; + if (nWidth > nMaxCols) + BITMAPERROR; for ( ny = 0; ny < nHeight; ny++ ) { |