diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-17 21:16:34 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2017-06-22 00:03:22 +0200 |
| commit | 8f81f6f743094d05a49f65c0f1ec8d99654780e6 (patch) | |
| tree | 3b042cf115f41f12e655e5681ba763361f52bb58 | |
| parent | 14141f72d6019cad66796ab12aaec686ae4db439 (diff) | |
ofz#2287 check multiply
Change-Id: Ibc4c93ac1f5686a476b5e303347dc951daa58e33
Reviewed-on: https://gerrit.libreoffice.org/38910
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Eike Rathke <erack@redhat.com>
| -rw-r--r-- | vcl/headless/svpbmp.cxx | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx index 5be976fc9e74..5ff0b0a978ee 100644 --- a/vcl/headless/svpbmp.cxx +++ b/vcl/headless/svpbmp.cxx @@ -135,8 +135,10 @@ BitmapBuffer* ImplCreateDIB( pDIB->maPalette.SetEntryCount( nColors ); } - const size_t size = pDIB->mnScanlineSize * pDIB->mnHeight; - if (size > SAL_MAX_INT32/2) + size_t size; + bFail = o3tl::checked_multiply<size_t>(pDIB->mnHeight, pDIB->mnScanlineSize, size); + SAL_WARN_IF(bFail, "vcl.gdi", "checked multiply failed"); + if (bFail || size > SAL_MAX_INT32/2) { delete pDIB; return nullptr; |