diff options
Diffstat (limited to 'svtools/source/filter.vcl')
| -rw-r--r-- | svtools/source/filter.vcl/igif/decode.cxx | 3 | ||||
| -rw-r--r-- | svtools/source/filter.vcl/ixpm/xpmread.cxx | 21 | ||||
| -rw-r--r-- | svtools/source/filter.vcl/wmf/wmfwr.cxx | 6 |
3 files changed, 20 insertions, 10 deletions
diff --git a/svtools/source/filter.vcl/igif/decode.cxx b/svtools/source/filter.vcl/igif/decode.cxx index 960a91845bf8..9babc02665a3 100644 --- a/svtools/source/filter.vcl/igif/decode.cxx +++ b/svtools/source/filter.vcl/igif/decode.cxx @@ -51,7 +51,6 @@ GIFLZWDecompressor::GIFLZWDecompressor( BYTE cDataSize ) : bEOIFound ( FALSE ), nDataSize ( cDataSize ) { - pTable = new GIFLZWTableEntry[ 4096 ]; pOutBuf = new BYTE[ 4096 ]; nClearCode = 1 << nDataSize; @@ -61,6 +60,8 @@ GIFLZWDecompressor::GIFLZWDecompressor( BYTE cDataSize ) : nOldCode = 0xffff; pOutBufData = pOutBuf + 4096; + pTable = new GIFLZWTableEntry[ 4098 ]; + for( USHORT i = 0; i < nTableSize; i++ ) { pTable[i].pPrev = NULL; diff --git a/svtools/source/filter.vcl/ixpm/xpmread.cxx b/svtools/source/filter.vcl/ixpm/xpmread.cxx index 0aa070e41596..1a667908f2f1 100644 --- a/svtools/source/filter.vcl/ixpm/xpmread.cxx +++ b/svtools/source/filter.vcl/ixpm/xpmread.cxx @@ -109,6 +109,10 @@ ReadState XPMReader::ReadXPM( Graphic& rGraphic ) mnColors = ImplGetULONG( 2 ); mnCpp = ImplGetULONG( 3 ); } + if ( mnColors > ( SAL_MAX_UINT32 / ( 4 + mnCpp ) ) ) + mbStatus = sal_False; + if ( ( mnWidth * mnCpp ) >= XPMSTRINGBUF ) + mbStatus = sal_False; if ( mbStatus && mnWidth && mnHeight && mnColors && mnCpp ) { mnIdentifier = XPMCOLORS; @@ -118,15 +122,20 @@ ReadState XPMReader::ReadXPM( Graphic& rGraphic ) // 1 Byte -> 0xff wenn Farbe transparent ist // 3 Bytes -> RGB Wert der Farbe mpColMap = new BYTE[ mnColors * ( 4 + mnCpp ) ]; - - for ( ULONG i = 0; i < mnColors; i++ ) + if ( mpColMap ) { - if ( ImplGetColor( i ) == FALSE ) + for ( ULONG i = 0; i < mnColors; i++ ) { - mbStatus = FALSE; - break; + if ( ImplGetColor( i ) == FALSE ) + { + mbStatus = FALSE; + break; + } } } + else + mbStatus = sal_False; + if ( mbStatus ) { // bei mehr als 256 Farben wird eine 24 Bit Grafik erstellt @@ -630,7 +639,7 @@ BOOL XPMReader::ImplGetString( void ) mnStatus &=~XPMSTRING; // end of parameter by eol break; } - if ( mnStringSize >= XPMSTRINGBUF ) + if ( mnStringSize >= ( XPMSTRINGBUF - 1 ) ) { mbStatus = FALSE; break; diff --git a/svtools/source/filter.vcl/wmf/wmfwr.cxx b/svtools/source/filter.vcl/wmf/wmfwr.cxx index ee3a71c51f9d..95c60f1265c1 100644 --- a/svtools/source/filter.vcl/wmf/wmfwr.cxx +++ b/svtools/source/filter.vcl/wmf/wmfwr.cxx @@ -755,7 +755,7 @@ void WMFWriter::WMFRecord_Polygon(const Polygon & rPoly) Polygon aSimplePoly; if ( rPoly.HasFlags() ) - rPoly.GetSimple( aSimplePoly ); + rPoly.AdaptiveSubdivide( aSimplePoly ); else aSimplePoly = rPoly; nSize = aSimplePoly.GetSize(); @@ -770,7 +770,7 @@ void WMFWriter::WMFRecord_PolyLine(const Polygon & rPoly) USHORT nSize,i; Polygon aSimplePoly; if ( rPoly.HasFlags() ) - rPoly.GetSimple( aSimplePoly ); + rPoly.AdaptiveSubdivide( aSimplePoly ); else aSimplePoly = rPoly; nSize=aSimplePoly.GetSize(); @@ -792,7 +792,7 @@ void WMFWriter::WMFRecord_PolyPolygon(const PolyPolygon & rPolyPoly) if ( aSimplePolyPoly[ i ].HasFlags() ) { Polygon aSimplePoly; - aSimplePolyPoly[ i ].GetSimple( aSimplePoly ); + aSimplePolyPoly[ i ].AdaptiveSubdivide( aSimplePoly ); aSimplePolyPoly[ i ] = aSimplePoly; } } |