summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2020-01-28 16:43:28 +0000
committerAndras Timar <andras.timar@collabora.com>2021-10-19 13:57:43 +0200
commit432a5bad80c39f2565de70fb451036c0b0c55238 (patch)
tree0b609539416fec14aa28238512533abec223451a
parentofz#20456 Null-dereference READ (diff)
downloadcore-432a5bad80c39f2565de70fb451036c0b0c55238.tar.gz
core-432a5bad80c39f2565de70fb451036c0b0c55238.zip
ofz#20366 OOM
Change-Id: If658720502739e6ad88c3cf73ac6674e0313a48b Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87648 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 090cf1e3bbe0ffaf56f22b152b73578483be2f42)
-rw-r--r--filter/source/graphicfilter/icgm/bitmap.cxx10
1 files changed, 9 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/icgm/bitmap.cxx b/filter/source/graphicfilter/icgm/bitmap.cxx
index f74ba6fb5d5b..c5613be6acf1 100644
--- a/filter/source/graphicfilter/icgm/bitmap.cxx
+++ b/filter/source/graphicfilter/icgm/bitmap.cxx
@@ -271,7 +271,15 @@ bool CGMBitmap::ImplGetDimensions( CGMBitmapDescriptor& rDesc )
rDesc.mbStatus = false;
sal_uInt32 nHeaderSize = 2 + 3 * nPrecision + 3 * mpCGM->ImplGetPointSize();
- rDesc.mnScanSize = ( ( rDesc.mnX * rDesc.mnDstBitsPerPixel + 7 ) >> 3 );
+
+ sal_uInt32 nWidthBits;
+ if (o3tl::checked_multiply(rDesc.mnX, rDesc.mnDstBitsPerPixel, nWidthBits))
+ {
+ rDesc.mbStatus = false;
+ return false;
+ }
+
+ rDesc.mnScanSize = (nWidthBits + 7) >> 3;
sal_uInt32 nScanSize;
nScanSize = rDesc.mnScanSize;