diff options
author | Caolán McNamara <caolanm@redhat.com> | 2017-05-15 11:17:57 +0100 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2017-06-01 22:09:31 +0200 |
commit | 237d45700eef31e23e8d10459335501f87540513 (patch) | |
tree | 557befebdafb106c9882745005ce4b71dd1acf61 /vcl/source | |
parent | 259c2409310814ae62c8d0aefef19a71e8d88dbe (diff) |
ofz#1605 check multiply and shift
Change-Id: I6aad9ad23e7bf080b3b610223f92df7074530beb
Reviewed-on: https://gerrit.libreoffice.org/37632
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl/source')
-rw-r--r-- | vcl/source/gdi/salmisc.cxx | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/vcl/source/gdi/salmisc.cxx b/vcl/source/gdi/salmisc.cxx index ffde759517fa..4f239efb95c6 100644 --- a/vcl/source/gdi/salmisc.cxx +++ b/vcl/source/gdi/salmisc.cxx @@ -20,6 +20,7 @@ #include <vcl/bitmapaccess.hxx> #include <vcl/salbtype.hxx> #include <bmpfast.hxx> +#include <o3tl/safeint.hxx> #include <osl/diagnose.h> #include <memory> @@ -328,7 +329,23 @@ BitmapBuffer* StretchAndConvert( pDstBuffer->mnFormat = nDstBitmapFormat; pDstBuffer->mnWidth = rTwoRect.mnDestWidth; pDstBuffer->mnHeight = rTwoRect.mnDestHeight; - pDstBuffer->mnScanlineSize = AlignedWidth4Bytes( pDstBuffer->mnBitCount * pDstBuffer->mnWidth ); + long nScanlineBase; + bool bFail = o3tl::checked_multiply<long>(pDstBuffer->mnBitCount, pDstBuffer->mnWidth, nScanlineBase); + if (bFail) + { + SAL_WARN("vcl.gdi", "checked multiply failed"); + pDstBuffer->mpBits = nullptr; + delete pDstBuffer; + return nullptr; + } + pDstBuffer->mnScanlineSize = AlignedWidth4Bytes(nScanlineBase); + if (pDstBuffer->mnScanlineSize < nScanlineBase/8) + { + SAL_WARN("vcl.gdi", "scanline calculation wraparound"); + pDstBuffer->mpBits = nullptr; + delete pDstBuffer; + return nullptr; + } try { pDstBuffer->mpBits = new sal_uInt8[ pDstBuffer->mnScanlineSize * pDstBuffer->mnHeight ]; |