diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-30 11:27:56 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-30 14:34:26 +0000 |
| commit | 123c4f4a6e418fa2babc1f0c383491833aeea947 (patch) | |
| tree | 78de034bd456f92b6f02b091e6d2dc82d443e0ec | |
| parent | 947875577f5c8a926f5c188a0f977a2713f245b1 (diff) | |
coverity#1242658 Untrusted loop bound
Change-Id: Ib37d08e5c55ca3c9f054684aa79dbe38d441f37a
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index 41ba717b6b13..a9dcff2922ae 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -758,9 +758,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo pPict->SeekRel( 6 ); pPict->ReadUInt16( nColTabSize ); - if ( ++nColTabSize > 256 ) + if (nColTabSize > 255) BITMAPERROR; + ++nColTabSize; + pAcc->SetPaletteEntryCount( nColTabSize ); for ( i = 0; i < nColTabSize; i++ ) @@ -1001,6 +1003,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo } else if ( nPackType == 2 ) { + const size_t nMaxPixels = pPict->remainingSize() / 3; + const size_t nMaxRows = nMaxPixels / nWidth; + if (nHeight > nMaxRows) + BITMAPERROR; + for ( ny = 0; ny < nHeight; ny++ ) { for ( nx = 0; nx < nWidth; nx++ ) |