diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-17 12:35:24 +0000 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2017-01-17 15:56:58 +0000 |
| commit | caa24065bc0436cde5aa5bd5de4f76c65b1933f0 (patch) | |
| tree | c74a5d439bb49bfd5e6ab4202ea184e0abaafd5c /vcl | |
| parent | 1eadd137ade5e2c4361990cce3f153e46110a1e9 (diff) | |
ofz#411: XPMReader::ImplGetColKey short read
Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
Reviewed-on: https://gerrit.libreoffice.org/33217
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/ixpm/xpmread.cxx | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/vcl/source/filter/ixpm/xpmread.cxx b/vcl/source/filter/ixpm/xpmread.cxx index 3d222584df96..6aaaa1c828ee 100644 --- a/vcl/source/filter/ixpm/xpmread.cxx +++ b/vcl/source/filter/ixpm/xpmread.cxx @@ -66,7 +66,7 @@ private: sal_uLong mnWidth; sal_uLong mnHeight; sal_uLong mnColors; - sal_uLong mnCpp; // characters per pix + sal_uInt32 mnCpp; // characters per pix bool mbTransparent; bool mbStatus; sal_uLong mnStatus; @@ -305,9 +305,12 @@ bool XPMReader::ImplGetColor( sal_uLong nNumb ) sal_uInt8* pPtr = ( mpColMap + nNumb * ( 4 + mnCpp ) ); bool bStatus = ImplGetString(); - if ( bStatus ) + if (bStatus && mnStringSize < mnCpp) + bStatus = false; + + if (bStatus) { - for ( sal_uLong i = 0; i < mnCpp; i++ ) + for (sal_uInt32 i = 0; i < mnCpp; ++i) *pPtr++ = *pString++; bStatus = ImplGetColSub ( pPtr ); } |