diff options
Diffstat (limited to 'vcl/headless/svpbmp.cxx')
| -rw-r--r-- | vcl/headless/svpbmp.cxx | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx index 202d63c0a84e..71c5e52586c6 100644 --- a/vcl/headless/svpbmp.cxx +++ b/vcl/headless/svpbmp.cxx @@ -27,7 +27,7 @@ #include <basegfx/vector/b2ivector.hxx> #include <basegfx/range/b2ibox.hxx> - +#include <o3tl/safeint.hxx> #include <vcl/salbtype.hxx> #include <vcl/bitmap.hxx> @@ -110,7 +110,21 @@ BitmapBuffer* ImplCreateDIB( pDIB->mnFormat |= ScanlineFormat::TopDown; pDIB->mnWidth = rSize.Width(); pDIB->mnHeight = rSize.Height(); - pDIB->mnScanlineSize = AlignedWidth4Bytes( pDIB->mnWidth * nBitCount ); + long nScanlineBase; + bool bFail = o3tl::checked_multiply<long>(pDIB->mnWidth, nBitCount, nScanlineBase); + if (bFail) + { + SAL_WARN("vcl.gdi", "checked multiply failed"); + delete pDIB; + return nullptr; + } + pDIB->mnScanlineSize = AlignedWidth4Bytes(nScanlineBase); + if (pDIB->mnScanlineSize < nScanlineBase/8) + { + SAL_WARN("vcl.gdi", "scanline calculation wraparound"); + delete pDIB; + return nullptr; + } pDIB->mnBitCount = nBitCount; if( nColors ) |