diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-03-03 10:30:51 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-03-03 13:58:49 +0100 |
| commit | 43518b29fddc7b824bdb1f7c8d2efcd220d6bc72 (patch) | |
| tree | 829c1ddf21df7d74f2d633c21c7d9402c3decf5d /filter | |
| parent | b3c18cdc07507bf4bc4bac14e792b1eb2294399a (diff) | |
cid#1458434 Untrusted loop bound
Change-Id: I3fd06ddf1548c1d6b5d8e91db944d2c720040718
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/89873
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index bbd59c055d34..fe9475d36170 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -1078,6 +1078,9 @@ sal_uInt64 PictReader::ReadPixMapEtc( BitmapEx &rBitmap, bool bBaseAddr, bool bC pBitmap.reset(new vcl::bitmap::RawBitmap( Size(nWidth, nHeight), 24 )); + // cid#1458434 to sanitize Untrusted loop bound + nWidth = pBitmap->Width(); + size_t nByteWidth = static_cast<size_t>(nWidth) * nCmpCount; std::vector<sal_uInt8> aScanline(nByteWidth); for (sal_uInt16 ny = 0; ny < nHeight; ++ny) |