diff options
Diffstat (limited to 'filter')
-rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 | ||||
-rw-r--r-- | filter/source/graphicfilter/itga/itga.cxx | 2 |
2 files changed, 8 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index a2d94c45faac..e2b5b8e383ab 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -652,7 +652,13 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline - if (pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) + bOk = pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines; + if (bOk) + { + long nResult; + bOk = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3; + } + if (bOk) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); diff --git a/filter/source/graphicfilter/itga/itga.cxx b/filter/source/graphicfilter/itga/itga.cxx index 211537f34e67..28cfb8dd25b8 100644 --- a/filter/source/graphicfilter/itga/itga.cxx +++ b/filter/source/graphicfilter/itga/itga.cxx @@ -143,7 +143,7 @@ bool TGAReader::ReadTGA(Graphic & rGraphic) { sal_Size nSize = mpFileHeader->nImageWidth; nSize *= mpFileHeader->nImageHeight; - if (nSize > SAL_MAX_INT32/2) + if (nSize > SAL_MAX_INT32/2/3) return false; mpBitmap.reset( new vcl::bitmap::RawBitmap( Size( mpFileHeader->nImageWidth, mpFileHeader->nImageHeight ) ) ); |