diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-14 15:11:06 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-14 21:22:02 +0100 |
| commit | 369018cffb6d1c77e2fb4feec6a4df8a27872ec5 (patch) | |
| tree | 1f4aaf932f1bb1e7de94fd83b43114b190f24828 /filter/source | |
| parent | c11c1afe58e0b4a25aaf1fdcf7b865f1c85fa727 (diff) | |
ofz#6330 Out-of-memory
Change-Id: Ie138705e7994915d7824d8cf1ae1a0e17e247256
Reviewed-on: https://gerrit.libreoffice.org/49740
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter/source')
| -rw-r--r-- | filter/source/graphicfilter/ipcx/ipcx.cxx | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/ipcx/ipcx.cxx b/filter/source/graphicfilter/ipcx/ipcx.cxx index c06a5159ec5e..51b50be2fa56 100644 --- a/filter/source/graphicfilter/ipcx/ipcx.cxx +++ b/filter/source/graphicfilter/ipcx/ipcx.cxx @@ -40,7 +40,7 @@ private: sal_uLong nPlanes; // no of planes sal_uLong nBytesPerPlaneLin; // bytes per plane line - sal_uLong nWidth, nHeight; // dimension in pixel + sal_uInt32 nWidth, nHeight; // dimension in pixel sal_uInt16 nResX, nResY; // resolution in pixel per inch or 0,0 sal_uInt16 nDestBitsPerPixel; // bits per pixel in destination bitmap 1,4,8 or 24 std::unique_ptr<sal_uInt8[]> @@ -96,6 +96,12 @@ bool PCXReader::ReadPCX(Graphic & rGraphic) bStatus = false; } + if (bStatus) + { + sal_uInt32 nResult; + bStatus = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3; + } + // Write BMP header and conditionally (maybe invalid for now) color palette: if (bStatus) { |