From 432a5bad80c39f2565de70fb451036c0b0c55238 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Tue, 28 Jan 2020 16:43:28 +0000 Subject: ofz#20366 OOM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: If658720502739e6ad88c3cf73ac6674e0313a48b Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87648 Tested-by: Jenkins Reviewed-by: Caolán McNamara (cherry picked from commit 090cf1e3bbe0ffaf56f22b152b73578483be2f42) --- filter/source/graphicfilter/icgm/bitmap.cxx | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/filter/source/graphicfilter/icgm/bitmap.cxx b/filter/source/graphicfilter/icgm/bitmap.cxx index f74ba6fb5d5b..c5613be6acf1 100644 --- a/filter/source/graphicfilter/icgm/bitmap.cxx +++ b/filter/source/graphicfilter/icgm/bitmap.cxx @@ -271,7 +271,15 @@ bool CGMBitmap::ImplGetDimensions( CGMBitmapDescriptor& rDesc ) rDesc.mbStatus = false; sal_uInt32 nHeaderSize = 2 + 3 * nPrecision + 3 * mpCGM->ImplGetPointSize(); - rDesc.mnScanSize = ( ( rDesc.mnX * rDesc.mnDstBitsPerPixel + 7 ) >> 3 ); + + sal_uInt32 nWidthBits; + if (o3tl::checked_multiply(rDesc.mnX, rDesc.mnDstBitsPerPixel, nWidthBits)) + { + rDesc.mbStatus = false; + return false; + } + + rDesc.mnScanSize = (nWidthBits + 7) >> 3; sal_uInt32 nScanSize; nScanSize = rDesc.mnScanSize; -- cgit