diff options
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index acef0b77ce3e..38e7cde58b09 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -906,7 +906,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo sal_uInt16 nByteCount, nCount, nD; sal_uLong nSrcBitsPos; - if ( nRowBytes < 2 * nWidth ) + if (nWidth > nRowBytes / 2) BITMAPERROR; size_t nMinRecordSize; @@ -921,6 +921,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo const size_t nMaxRows = pPict->remainingSize() / nMinRowWidth; if (nHeight > nMaxRows) BITMAPERROR; + const size_t nMaxCols = pPict->remainingSize() / nHeight; + if (nWidth > nMaxCols) + BITMAPERROR; for ( ny = 0; ny < nHeight; ny++ ) { |