diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-02 19:22:19 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-06-15 15:57:46 +0200 |
| commit | 9863be5254fcce6b74da30b821e9263002e9ac71 (patch) | |
| tree | 3f97a499703853206e08e8f175472ff2d0c6f4fe /filter/source | |
| parent | b279282c364f3c59b25bd9c8a5ece2d29e8bd9f3 (diff) | |
ofz#2085: fix remaining length check
Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
Reviewed-on: https://gerrit.libreoffice.org/38361
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter/source')
| -rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index 34e68abfc0d8..81841d8b0891 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -647,15 +647,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); |