From 9863be5254fcce6b74da30b821e9263002e9ac71 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Fri, 2 Jun 2017 19:22:19 +0100 Subject: ofz#2085: fix remaining length check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1 Reviewed-on: https://gerrit.libreoffice.org/38361 Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- filter/source/graphicfilter/ieps/ieps.cxx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'filter/source') diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index 34e68abfc0d8..81841d8b0891 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -647,15 +647,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); -- cgit /option> LibreOffice 核心代码仓库文档基金会
summaryrefslogtreecommitdiff
path: root/writerfilter/source/doctok/XNoteHelper.hxx
diff options
context:
space:
mode:
authorArmin Le Grand <alg@apache.org>2014-07-14 19:09:11 +0000
committerArmin Le Grand <alg@apache.org>2014-07-14 19:09:11 +0000
commit3c1d4742e649fe9c8aed8c2817fe3e1f3364f298 (patch)
treee0c6e02c89aa9227726c9469da1001b3e29c41df /writerfilter/source/doctok/XNoteHelper.hxx
parentc5c31e2aeaedbdf76e1f38d3c385e34f5ed875ca (diff)
Resync to trunk, windows non-pro build aoo/aw080
Diffstat (limited to 'writerfilter/source/doctok/XNoteHelper.hxx')