From b269b4ac77cbc1f5076ae18f279ece3fd3c20fc0 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 7 Mar 2020 19:24:42 +0000
Subject: ofz#20622 oom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Id77d90197e98d29787a40966f248dd769c9dac28
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90175
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 1e95c2c17a49349caba1e62b4de3752c5f767f01)
---
 include/vcl/BitmapTools.hxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/vcl/BitmapTools.hxx b/include/vcl/BitmapTools.hxx
index 6a8f6c8b9605..3f4847609d30 100644
--- a/include/vcl/BitmapTools.hxx
+++ b/include/vcl/BitmapTools.hxx
@@ -45,7 +45,8 @@ public:
         assert(nBitCount == 24 || nBitCount == 32);
         sal_Int32 nRowSize, nDataSize;
         if (o3tl::checked_multiply<sal_Int32>(rSize.getWidth(), nBitCount/8, nRowSize) ||
-            o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize))
+            o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize) ||
+            nDataSize < 0)
         {
             throw std::bad_alloc();
         }
-- 
cgit