diff options
| author | Armin Le Grand <Armin.Le.Grand@cib.de> | 2017-10-30 16:29:09 +0100 |
|---|---|---|
| committer | Armin Le Grand <Armin.Le.Grand@cib.de> | 2018-04-17 02:05:57 +0200 |
| commit | 7f9b0f47979dcb7abfed37bb7cd38ab51eac6011 (patch) | |
| tree | 639b6289605dc4b108b70d2da56dd214e62a5be1 /vcl | |
| parent | 0f93692fda4226323422cf82ce34ae4bd5e22fab (diff) | |
tdf#113197 Add MaskPrimitive (clip) to EMF/WMF if needed
Added code to quartz vcl implementation that takes care
when BitmapPalette.count != (depth^^2)-1 - which may
be the case anytime. If then a bitmap value exists that
goes beyond that count, a invalid access was executed
Change-Id: Iab332c91b8753aab85e9d365323f5c9e531efab2
Reviewed-on: https://gerrit.libreoffice.org/44058
Reviewed-by: Bartosz Kosiorek <gang65@poczta.onet.pl>
Tested-by: Jenkins <ci@libreoffice.org>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/quartz/salbmp.cxx | 32 |
1 files changed, 27 insertions, 5 deletions
diff --git a/vcl/quartz/salbmp.cxx b/vcl/quartz/salbmp.cxx index 891370a96833..7146461c7af1 100644 --- a/vcl/quartz/salbmp.cxx +++ b/vcl/quartz/salbmp.cxx @@ -438,11 +438,13 @@ class ImplPixelFormat8 : public ImplPixelFormat private: sal_uInt8* pData; const BitmapPalette& mrPalette; + const sal_uInt8 mnPaletteCount; public: explicit ImplPixelFormat8( const BitmapPalette& rPalette ) : pData(nullptr) , mrPalette(rPalette) + , mnPaletteCount(static_cast< sal_uInt8 >(rPalette.GetEntryCount())) { } virtual void StartLine( sal_uInt8* pLine ) override { pData = pLine; } @@ -452,7 +454,13 @@ public: } virtual Color ReadPixel() override { - return mrPalette[ *pData++ ].GetColor(); + const sal_uInt8 nIndex(*pData++); + + // Caution(!) rPalette.GetEntryCount() may be != (depth^^2)-1 (!) + if(nIndex < mnPaletteCount) + return mrPalette[nIndex].GetColor(); + else + return Color(COL_BLACK); } virtual void WritePixel( Color nColor ) override { @@ -465,6 +473,7 @@ class ImplPixelFormat4 : public ImplPixelFormat private: sal_uInt8* pData; const BitmapPalette& mrPalette; + const sal_uInt8 mnPaletteCount; sal_uInt32 mnX; sal_uInt32 mnShift; @@ -472,6 +481,7 @@ public: explicit ImplPixelFormat4( const BitmapPalette& rPalette ) : pData(nullptr) , mrPalette(rPalette) + , mnPaletteCount(static_cast< sal_uInt8 >(rPalette.GetEntryCount())) , mnX(0) , mnShift(0) { @@ -492,10 +502,15 @@ public: } virtual Color ReadPixel() override { - const BitmapColor& rColor = mrPalette[( pData[mnX >> 1] >> mnShift) & 0x0f]; + // Caution(!) rPalette.GetEntryCount() may be != (depth^^2)-1 (!) + const sal_uInt8 nIndex(( pData[mnX >> 1] >> mnShift) & 0x0f); mnX++; mnShift ^= 4; - return rColor.GetColor(); + + if(nIndex < mnPaletteCount) + return mrPalette[nIndex].GetColor(); + else + return Color(COL_BLACK); } virtual void WritePixel( Color nColor ) override { @@ -511,12 +526,14 @@ class ImplPixelFormat1 : public ImplPixelFormat private: sal_uInt8* pData; const BitmapPalette& mrPalette; + const sal_uInt8 mnPaletteCount; sal_uInt32 mnX; public: explicit ImplPixelFormat1( const BitmapPalette& rPalette ) : pData(nullptr) , mrPalette(rPalette) + , mnPaletteCount(static_cast< sal_uInt8 >(rPalette.GetEntryCount())) , mnX(0) { } @@ -531,9 +548,14 @@ public: } virtual Color ReadPixel() override { - const BitmapColor& rColor = mrPalette[ (pData[mnX >> 3 ] >> ( 7 - ( mnX & 7 ) )) & 1]; + // Caution(!) rPalette.GetEntryCount() may be != (depth^^2)-1 (!) + const sal_uInt8 nIndex( (pData[mnX >> 3 ] >> ( 7 - ( mnX & 7 ) )) & 1); mnX++; - return rColor.GetColor(); + + if(nIndex < mnPaletteCount) + return mrPalette[nIndex].GetColor(); + else + return Color(COL_BLACK); } virtual void WritePixel( Color nColor ) override { |