summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2020-03-07 19:24:42 +0000
committerAndras Timar <andras.timar@collabora.com>2021-10-19 13:57:44 +0200
commitb269b4ac77cbc1f5076ae18f279ece3fd3c20fc0 (patch)
tree35dc56fb49e9d44542627dee317ae681b1513f0f
parentofz#20517 null-dereference (diff)
downloadcore-b269b4ac77cbc1f5076ae18f279ece3fd3c20fc0.tar.gz
core-b269b4ac77cbc1f5076ae18f279ece3fd3c20fc0.zip
ofz#20622 oom
Change-Id: Id77d90197e98d29787a40966f248dd769c9dac28 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90175 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 1e95c2c17a49349caba1e62b4de3752c5f767f01)
-rw-r--r--include/vcl/BitmapTools.hxx3
1 files changed, 2 insertions, 1 deletions
diff --git a/include/vcl/BitmapTools.hxx b/include/vcl/BitmapTools.hxx
index 6a8f6c8b9605..3f4847609d30 100644
--- a/include/vcl/BitmapTools.hxx
+++ b/include/vcl/BitmapTools.hxx
@@ -45,7 +45,8 @@ public:
assert(nBitCount == 24 || nBitCount == 32);
sal_Int32 nRowSize, nDataSize;
if (o3tl::checked_multiply<sal_Int32>(rSize.getWidth(), nBitCount/8, nRowSize) ||
- o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize))
+ o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize) ||
+ nDataSize < 0)
{
throw std::bad_alloc();
}