From aaad67afccf1c59bf7d8fe7ab5207ff903f1c515 Mon Sep 17 00:00:00 2001
From: zhutyra <zhutyra>
Date: Tue, 1 Feb 2022 13:54:55 +0000
Subject: read of width/height uses wrong record size

this initially went wrong at:

commit b4fb7a437bb0ce987702b12008737756623618ac
Date:   Mon May 23 21:38:40 2011 +0100

    fix up some more endian

LIBREOFFICE-SBQ5TJRS

Change-Id: Ie418f530f55288351f73f3c0cbab9ac48e6b6964
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129259
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 6694e3ea9c2f05a20245d94c5c1eda955cb3aacc)
---
 lotuswordpro/source/filter/lwpdrawobj.cxx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 642dfed338ec..fd5355ac3295 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1394,8 +1394,12 @@ void LwpDrawBitmap::Read()
 
     if (aInfoHeader2.nHeaderLen == sizeof(BmpInfoHeader))
     {
-        m_pStream->ReadUInt32( aInfoHeader2.nWidth );
-        m_pStream->ReadUInt32( aInfoHeader2.nHeight );
+        sal_uInt16 nTmp;
+
+        m_pStream->ReadUInt16( nTmp );
+        aInfoHeader2.nWidth = nTmp;
+        m_pStream->ReadUInt16( nTmp );
+        aInfoHeader2.nHeight = nTmp;
         m_pStream->ReadUInt16( aInfoHeader2.nPlanes );
         m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
 
-- 
cgit