diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-05-15 11:17:57 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-06-01 22:09:31 +0200 |
| commit | 237d45700eef31e23e8d10459335501f87540513 (patch) | |
| tree | 557befebdafb106c9882745005ce4b71dd1acf61 /vcl/unx/generic/gdi | |
| parent | 259c2409310814ae62c8d0aefef19a71e8d88dbe (diff) | |
ofz#1605 check multiply and shift
Change-Id: I6aad9ad23e7bf080b3b610223f92df7074530beb
Reviewed-on: https://gerrit.libreoffice.org/37632
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl/unx/generic/gdi')
| -rw-r--r-- | vcl/unx/generic/gdi/salbmp.cxx | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/vcl/unx/generic/gdi/salbmp.cxx b/vcl/unx/generic/gdi/salbmp.cxx index 73fc5a424152..00043d5e783e 100644 --- a/vcl/unx/generic/gdi/salbmp.cxx +++ b/vcl/unx/generic/gdi/salbmp.cxx @@ -41,6 +41,7 @@ #include <unx/salinst.h> #include <unx/x11/xlimits.hxx> +#include <o3tl/safeint.hxx> #include <opengl/salbmp.hxx> #include <vcl/opengl/OpenGLHelper.hxx> @@ -193,7 +194,21 @@ BitmapBuffer* X11SalBitmap::ImplCreateDIB( pDIB->mnWidth = rSize.Width(); pDIB->mnHeight = rSize.Height(); - pDIB->mnScanlineSize = AlignedWidth4Bytes( pDIB->mnWidth * nBitCount ); + long nScanlineBase; + bool bFail = o3tl::checked_multiply<long>(pDIB->mnWidth, nBitCount, nScanlineBase); + if (bFail) + { + SAL_WARN("vcl.gdi", "checked multiply failed"); + delete pDIB; + return nullptr; + } + pDIB->mnScanlineSize = AlignedWidth4Bytes(nScanlineBase); + if (pDIB->mnScanlineSize < nScanlineBase/8) + { + SAL_WARN("vcl.gdi", "scanline calculation wraparound"); + delete pDIB; + return nullptr; + } pDIB->mnBitCount = nBitCount; if( nColors ) |