diff options
author | Caolán McNamara <caolanm@redhat.com> | 2018-01-24 10:20:16 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2018-01-24 21:28:52 +0100 |
commit | 5f0e9a17e769e3f1f8c5f58df334cd130912e5fd (patch) | |
tree | 950e2b962265f15239045fc43375bc3d602e0b79 /vcl | |
parent | ea91dedef71a0c476dc168f39654c1212c46f824 (diff) |
ofz#5573 Out of memory
Change-Id: Ia0b291f23cd20306001f5d513eab62c49e924fa7
Reviewed-on: https://gerrit.libreoffice.org/48489
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl')
-rw-r--r-- | vcl/source/filter/igif/gifread.cxx | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/vcl/source/filter/igif/gifread.cxx b/vcl/source/filter/igif/gifread.cxx index 5667960c5766..2afaa92d16d2 100644 --- a/vcl/source/filter/igif/gifread.cxx +++ b/vcl/source/filter/igif/gifread.cxx @@ -158,6 +158,8 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal, const Size aSize( nWidth, nHeight ); sal_uInt64 nCombinedPixSize = nWidth * nHeight; + if (bGCTransparent) + nCombinedPixSize += (nCombinedPixSize/8); // "Overall data compression asymptotically approaches 3839 × 8 / 12 = 2559 1/3" // so assume compression of 1:2560 is possible @@ -167,9 +169,10 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal, sal_uInt64 nMinFileData = nWidth * nHeight / 2560; for (size_t i = 0; i < aAnimation.Count(); ++i) { - const Size& rSize = aAnimation.Get(i).aSizePix; + const AnimationBitmap& rBitmap = aAnimation.Get(i); + const Size& rSize = rBitmap.aSizePix; nMinFileData += rSize.Width() * rSize.Height() / 2560; - nCombinedPixSize += rSize.Width() * rSize.Height(); + nCombinedPixSize += rBitmap.aBmpEx.GetSizeBytes(); } if (nMaxStreamData < nMinFileData) @@ -187,7 +190,7 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal, // svtools/qa/cppunit/data/gif/fail/CVE-2008-5937-1.gif), but // which doesn't fail on 64-bit Mac OS X at least. Why the loading // fails on 64-bit Linux, no idea. - if (nCombinedPixSize >= 64000U * 64000U) + if (nCombinedPixSize >= SAL_MAX_INT32/3*2) { bStatus = false; return; |