diff options
author | Caolán McNamara <caolanm@redhat.com> | 2014-11-24 10:45:44 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2014-11-24 16:35:57 +0000 |
commit | 5eb4ccb005f86717f886e5bc0079c739904eec61 (patch) | |
tree | efac283483e4d8f59c1368c27a4b0e54db3c7412 /filter/source | |
parent | coverity#1242421 Dereference after null check (diff) | |
download | core-5eb4ccb005f86717f886e5bc0079c739904eec61.tar.gz core-5eb4ccb005f86717f886e5bc0079c739904eec61.zip |
coverity#1242658 Untrusted loop bound
Change-Id: Ie22cb785065342582ca59f871a7b4da7e7bc77e5
Diffstat (limited to 'filter/source')
-rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index acef0b77ce3e..38e7cde58b09 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -906,7 +906,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo sal_uInt16 nByteCount, nCount, nD; sal_uLong nSrcBitsPos; - if ( nRowBytes < 2 * nWidth ) + if (nWidth > nRowBytes / 2) BITMAPERROR; size_t nMinRecordSize; @@ -921,6 +921,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo const size_t nMaxRows = pPict->remainingSize() / nMinRowWidth; if (nHeight > nMaxRows) BITMAPERROR; + const size_t nMaxCols = pPict->remainingSize() / nHeight; + if (nWidth > nMaxCols) + BITMAPERROR; for ( ny = 0; ny < nHeight; ny++ ) { |