diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-22 21:57:38 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-01-22 21:57:38 +0000 |
| commit | e59b69010c9eca5b7c1dd3102141d9a23ab1c5a5 (patch) | |
| tree | 43835522031da874524e3e8ccd25f778cd09821e /vcl | |
| parent | f42a57528f3c2a07ad302b0d6b22946ee58b77c3 (diff) | |
coverity#1399045 Untrusted value as argument
Change-Id: Icac88c7b439036434cbf2352ac50e954139db4ce
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/sgfbram.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/vcl/source/filter/sgfbram.cxx b/vcl/source/filter/sgfbram.cxx index bfd70123f276..e25d01fe0afd 100644 --- a/vcl/source/filter/sgfbram.cxx +++ b/vcl/source/filter/sgfbram.cxx @@ -290,6 +290,14 @@ bool SgfFilterBMap(SvStream& rInp, SvStream& rOut, SgfHeader& rHead, SgfEntry&) rOut.WriteBytes(pBuf.get(), nWdtOut); } } else if (nColors==256) { + + //we're going to loop Ysize * XSize on GetByte, max compression for GetByte is a run of 63 + //if we're less than that (and add a generous amount of wriggle room) then its not going + //to fly + const sal_uInt64 nMinBytesPossiblyNeeded = rHead.Xsize * rHead.Ysize / 128; + if (rInp.remainingSize() < nMinBytesPossiblyNeeded) + return false; + cRGB[3]=0; // fourth palette entry for BMP for (sal_uInt16 i=0;i<256;i++) { // copy palette rInp.ReadBytes(cRGB, 3); @@ -325,6 +333,7 @@ bool SgfBMapFilter(SvStream& rInp, SvStream& rOut) ReadSgfHeader( rInp, aHead ); if (!rInp.good()) return false; + if (aHead.ChkMagic() && (aHead.Typ==SgfBitImag0 || aHead.Typ==SgfBitImag1 || aHead.Typ==SgfBitImag2 || aHead.Typ==SgfBitImgMo)) { |