From f78090e3d5cc21f8b6c110b39d9f2057d2fa24e9 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 30 Sep 2019 09:35:23 +0100 Subject: ofz#17817 avoid OOM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I354edf5b169e797c76ec79719cdce01e63329df4 Reviewed-on: https://gerrit.libreoffice.org/79833 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- emfio/source/reader/wmfreader.cxx | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'emfio/source') diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index d1e7f85b1c67..58c4d971cb49 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -711,9 +711,15 @@ namespace emfio bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1 && nBytesPerScan != 0; if (bOk) { + // must be enough data to fulfil the request bOk = nBytesPerScan <= mpInputStream->remainingSize() / nHeight; } if (bOk) + { + // scanline must be large enough to provide all pixels + bOk = nBytesPerScan >= nWidth / 8; + } + if (bOk) { vcl::bitmap::RawBitmap aBmp( Size( nWidth, nHeight ), 24 ); for (sal_uInt16 y = 0; y < nHeight && mpInputStream->good(); ++y) -- cgit