diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-13 13:38:07 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-13 21:42:45 +0100 |
| commit | c137652c30667ffe1dde40c22ee9584190f26dc9 (patch) | |
| tree | 5381291b493ced724aae6b65289d546e072f5552 /filter | |
| parent | ofz#6287 limit palette index (diff) | |
| download | core-c137652c30667ffe1dde40c22ee9584190f26dc9.tar.gz core-c137652c30667ffe1dde40c22ee9584190f26dc9.zip | |
ofz#6291 Out-of-memory
Change-Id: Ib68f1a2804a75a482cc72c68b2de4d266c8cbeb4
Reviewed-on: https://gerrit.libreoffice.org/49653
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ipbm/ipbm.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx index 1de647434f7e..686f32119a97 100644 --- a/filter/source/graphicfilter/ipbm/ipbm.cxx +++ b/filter/source/graphicfilter/ipbm/ipbm.cxx @@ -18,7 +18,7 @@ */ #include <sal/config.h> - +#include <o3tl/safeint.hxx> #include <vcl/FilterConfigItem.hxx> #include <vcl/graph.hxx> #include <vcl/BitmapTools.hxx> @@ -84,9 +84,11 @@ bool PBMReader::ReadPBM(Graphic & rGraphic ) { case 0: { - const size_t nRemainingSize = mrPBM.remainingSize(); - const size_t nDataRequired = static_cast<size_t>(mnWidth) * (mnHeight / 8); - if (nRemainingSize < nDataRequired) + sal_uInt32 nDataRequired; + if (o3tl::checked_multiply<sal_uInt32>(mnWidth, mnHeight, nDataRequired)) + return false; + const auto nRemainingSize = mrPBM.remainingSize(); + if (nRemainingSize < nDataRequired / 8) return false; mpRawBmp.reset( new vcl::bitmap::RawBitmap( Size( mnWidth, mnHeight ) ) ); |