diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-09-29 09:30:29 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-09-29 11:10:27 +0100 |
| commit | f1a9c5276d46988e9fb15943e7b019c224d5ad47 (patch) | |
| tree | d6519048d922b2771f47149164cd0eabf24c870e /vcl | |
| parent | 7be2fba41dfb184a0bf6f5c7f197e2222d43f3e8 (diff) | |
coverity#1242704 Untrusted loop bound
Change-Id: Id8a80028ad00ec7ae79eaa9d877a1fef9f4d082c
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index 9e446c06cfb3..463e8a808925 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -643,7 +643,12 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc ) Point aPoint( ReadYX() ); pWMF->ReadUInt16( nDontKnow ).ReadUInt16( nWidth ).ReadUInt16( nHeight ).ReadUInt16( nBytesPerScan ).ReadUChar( nPlanes ).ReadUChar( nBitCount ); - if ( nWidth && nHeight && ( nPlanes == 1 ) && ( nBitCount == 1 ) ) + bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1; + if (bOk) + { + bOk = nBytesPerScan <= pWMF->remainingSize() / nHeight; + } + if (bOk) { Bitmap aBmp( Size( nWidth, nHeight ), nBitCount ); BitmapWriteAccess* pAcc; |