diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-08-28 09:23:03 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2014-08-28 05:03:09 -0500 |
| commit | 0ec580e7aa010e38f7c742b2fae5646ccdf4bede (patch) | |
| tree | 65efc5e8865e085707d27602d48448df38900952 | |
| parent | 5041bbd4f95f7a55e07aa0dbb45fc06e3210d227 (diff) | |
keep nScanlineStride number sane
bff + valgrind
Change-Id: I255a052251a6a0f1e4005b9cfb3b6ce00c6653ee
(cherry picked from commit 35412949a2fb2a4472177a0289de4f0c062b674d)
Reviewed-on: https://gerrit.libreoffice.org/11162
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
| -rw-r--r-- | basebmp/source/bitmapdevice.cxx | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/basebmp/source/bitmapdevice.cxx b/basebmp/source/bitmapdevice.cxx index bf3de07a80eb..4104c186cdf5 100644 --- a/basebmp/source/bitmapdevice.cxx +++ b/basebmp/source/bitmapdevice.cxx @@ -1952,12 +1952,15 @@ BitmapDeviceSharedPtr createBitmapDeviceImplInner( const basegfx::B2IVector& nScanlineFormat > FORMAT_MAX ) return BitmapDeviceSharedPtr(); - - - sal_Int32 nScanlineStride(0); - + sal_uInt8 nBitsPerPixel = bitsPerPixel[nScanlineFormat]; + if (rSize.getX() > (SAL_MAX_INT32-7) / nBitsPerPixel) + { + SAL_WARN("basebmp", "suspicious bitmap width " << + rSize.getX() << " for depth " << nBitsPerPixel); + return BitmapDeviceSharedPtr(); + } // round up to full 8 bit, divide by 8 - nScanlineStride = (rSize.getX()*bitsPerPixel[nScanlineFormat] + 7) >> 3; + sal_Int32 nScanlineStride = (rSize.getX()*nBitsPerPixel + 7) >> 3; // rounded up to next full power-of-two number of bytes const sal_uInt32 bytesPerPixel = nextPow2( |