diff options
| author | zhutyra <zhutyra> | 2022-02-01 13:54:55 +0000 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2022-04-01 14:45:59 +0200 |
| commit | 22ad2eb9bb4f08a188616d2710aae07039397131 (patch) | |
| tree | e22500ef04c0c9a138762b3ba68bd4d513afd01b | |
| parent | ensure bounds checking (diff) | |
| download | core-22ad2eb9bb4f08a188616d2710aae07039397131.tar.gz core-22ad2eb9bb4f08a188616d2710aae07039397131.zip | |
read of width/height uses wrong record size
this initially went wrong at:
commit b4fb7a437bb0ce987702b12008737756623618ac
Date: Mon May 23 21:38:40 2011 +0100
fix up some more endian
LIBREOFFICE-SBQ5TJRS
Change-Id: Ie418f530f55288351f73f3c0cbab9ac48e6b6964
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129259
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 6694e3ea9c2f05a20245d94c5c1eda955cb3aacc)
(cherry picked from commit aaad67afccf1c59bf7d8fe7ab5207ff903f1c515)
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index c09c0304bedd..a0d5ef65d360 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1371,8 +1371,12 @@ void LwpDrawBitmap::Read() if (aInfoHeader2.nHeaderLen == sizeof(BmpInfoHeader)) { - m_pStream->ReadUInt32( aInfoHeader2.nWidth ); - m_pStream->ReadUInt32( aInfoHeader2.nHeight ); + sal_uInt16 nTmp; + + m_pStream->ReadUInt16( nTmp ); + aInfoHeader2.nWidth = nTmp; + m_pStream->ReadUInt16( nTmp ); + aInfoHeader2.nHeight = nTmp; m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); |