summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--lotuswordpro/source/filter/lwpdrawobj.cxx13
1 files changed, 10 insertions, 3 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 7240a57d13b9..7bcfcf155e89 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1352,14 +1352,21 @@ void LwpDrawBitmap::Read()
m_pStream->ReadUInt16( m_aBmpRec.nTranslation );
m_pStream->ReadUInt16( m_aBmpRec.nRotation );
+ if (m_aObjHeader.nRecLen < 20)
+ throw BadRead();
+
// 20 == length of draw-specific fields.
// 14 == length of bmp file header.
m_aBmpRec.nFileSize = m_aObjHeader.nRecLen - 20 + 14;
- m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] );
BmpInfoHeader2 aInfoHeader2;
m_pStream->ReadUInt32( aInfoHeader2.nHeaderLen );
+ if (!m_pStream->good())
+ throw BadRead();
+
+ m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] );
+
sal_uInt32 N;
sal_uInt32 rgbTableSize;
@@ -1371,7 +1378,7 @@ void LwpDrawBitmap::Read()
m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
- if (N == 24)
+ if (N >= 16)
{
rgbTableSize = 0;
}
@@ -1387,7 +1394,7 @@ void LwpDrawBitmap::Read()
m_pStream->ReadUInt16( aInfoHeader2.nPlanes );
m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount;
- if (N == 24)
+ if (N >= 16)
{
rgbTableSize = 0;
}