diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-02 19:22:19 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-06-02 20:24:13 +0200 |
| commit | 3b96a1690c617f53844925e105f36e138e7e3d56 (patch) | |
| tree | c8074e9bc0d00eea1663ed99031bb871999479df /filter | |
| parent | 610968f029f87315341cc43d08afd4c69b0c4ae7 (diff) | |
ofz: fix remaining length check
Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
Reviewed-on: https://gerrit.libreoffice.org/38362
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index 954668bdea92..ba887d421f98 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -647,15 +647,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); |