diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2016-03-16 13:31:06 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2016-03-16 13:31:06 +0000 |
| commit | 7055a93318e18853184235753abe247f93a3b085 (patch) | |
| tree | 0047b679d4cc7880fec120401d125cc2fa51c1f0 /filter | |
| parent | 6eb7cd38e348e8a9d6498bfc2d41e91725eb34aa (diff) | |
coverity#1242658 Untrusted loop bound
Change-Id: Iae002c0f925772a56f56162b0e4ac63de2b50d10
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index aff44cd5f63c..223efb72838f 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -834,10 +834,21 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo if ( nRowBytes < nSrcBPL || nRowBytes > nDestBPL ) BITMAPERROR; - if ( nRowBytes < 8 || nPackType == 1 ) { + if (nRowBytes < 8 || nPackType == 1) + { if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt8) * nRowBytes)) BITMAPERROR; } + else if (nRowBytes > 250) + { + if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16)) + BITMAPERROR; + } + else + { + if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8)) + BITMAPERROR; + } for (sal_uInt16 ny = 0; ny < nHeight; ++ny) { @@ -907,10 +918,21 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo if (nWidth > nRowBytes / 2) BITMAPERROR; - if ( nRowBytes < 8 || nPackType == 1 ) { + if (nRowBytes < 8 || nPackType == 1) + { if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt16) * nWidth)) BITMAPERROR; } + else if (nRowBytes > 250) + { + if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16)) + BITMAPERROR; + } + else + { + if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8)) + BITMAPERROR; + } for (sal_uInt16 ny = 0; ny < nHeight; ++ny) { |