we don't actually need width amount of data in advance to fill the width

seeing as we seek from previous position + bytecount on each loop
we can only be sure we go forward the min (+1/+2) for each iteration

Change-Id: I4f1a29d96c43ee8aa858c97405d196b89994669b

1 files changed, 7 insertions, 7 deletions

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 2fa6228d40f5..9d9499652b34 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -851,14 +851,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt8) * nRowBytes))
                 return 0xffffffff;
         }
-        else if (nRowBytes > 250)
-        {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16))
-                return 0xffffffff;
-        }
         else
         {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8))
+            size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
+            if (nHeight > pPict->remainingSize() / nByteCountSize)
                 return 0xffffffff;
         }
 
@@ -941,7 +937,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         else
         {
             size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
-            if (nHeight > pPict->remainingSize() / ((nByteCountSize + sizeof(sal_uInt8)) * nWidth))
+            if (nHeight > pPict->remainingSize() / nByteCountSize)
                 return 0xffffffff;
         }
 
@@ -1087,6 +1083,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
                 if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
                     return 0xffffffff;
 
+                size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
+                if (nHeight > pPict->remainingSize() / nByteCountSize)
+                    return 0xffffffff;
+
                 std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
                 for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
                 {