From 72da4c623baf60eb2b7073697cd36ffb3022847d Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sun, 29 Aug 2021 16:58:11 +0100
Subject: ofz#37796 limit to numeric_limits<int>::max
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I6e09226fad1e566ba2758d0084042b603b84d221
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121230
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 include/vcl/RawBitmap.hxx | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'include')

diff --git a/include/vcl/RawBitmap.hxx b/include/vcl/RawBitmap.hxx
index b26d532a4032..19fe94cd2c59 100644
--- a/include/vcl/RawBitmap.hxx
+++ b/include/vcl/RawBitmap.hxx
@@ -31,6 +31,10 @@ public:
         , mnBitCount(nBitCount)
     {
         assert(nBitCount == 24 || nBitCount == 32);
+        if (rSize.getWidth() > std::numeric_limits<sal_Int32>::max() || rSize.getWidth() < 0)
+            throw std::bad_alloc();
+        if (rSize.getHeight() > std::numeric_limits<sal_Int32>::max() || rSize.getHeight() < 0)
+            throw std::bad_alloc();
         sal_Int32 nRowSize, nDataSize;
         if (o3tl::checked_multiply<sal_Int32>(rSize.getWidth(), nBitCount / 8, nRowSize)
             || o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize)
-- 
cgit