diff options
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index ae0fc5bb9c05..ec617fb24346 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1373,14 +1373,21 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( m_aBmpRec.nTranslation ); m_pStream->ReadUInt16( m_aBmpRec.nRotation ); + if (m_aObjHeader.nRecLen < 20) + throw BadRead(); + // 20 == length of draw-specific fields. // 14 == length of bmp file header. m_aBmpRec.nFileSize = m_aObjHeader.nRecLen - 20 + 14; - m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] ); BmpInfoHeader2 aInfoHeader2; m_pStream->ReadUInt32( aInfoHeader2.nHeaderLen ); + if (!m_pStream->good()) + throw BadRead(); + + m_pImageData.reset( new sal_uInt8 [m_aBmpRec.nFileSize] ); + sal_uInt32 N; sal_uInt32 rgbTableSize; @@ -1395,7 +1402,7 @@ void LwpDrawBitmap::Read() throw BadRead(); N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; - if (N == 24) + if (N >= 16) { rgbTableSize = 0; } @@ -1415,7 +1422,7 @@ void LwpDrawBitmap::Read() throw BadRead(); N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; - if (N == 24) + if (N >= 16) { rgbTableSize = 0; } |