summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-08-24 20:43:37 +0100
committerDavid Tardon <dtardon@redhat.com>2015-08-25 07:49:25 +0000
commit25418bf4997e3f1b31e0da87ee0947ad9c8da2ce (patch)
treef2f64ebd11fcfd299781c8bd1beb6bc2573894f9
parent436ccb0df15c1c654e5b3eebfd3ba94ddd2341c5 (diff)
in reality we are limited to max sal_Int32 here
so accept that and test if the values were accepted or limited Change-Id: Iaed5ebc2f12b52055506147c71117a2ad88d28ac (cherry picked from commit 0a76c1fd6875bd094ebe2bfbed3d01c98dc0c19e) Reviewed-on: https://gerrit.libreoffice.org/17972 Reviewed-by: David Tardon <dtardon@redhat.com> Tested-by: David Tardon <dtardon@redhat.com>
-rw-r--r--filter/qa/cppunit/data/pbm/fail/crash-1.pbm6
-rw-r--r--filter/source/graphicfilter/ipbm/ipbm.cxx11
2 files changed, 12 insertions, 5 deletions
diff --git a/filter/qa/cppunit/data/pbm/fail/crash-1.pbm b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
new file mode 100644
index 000000000000..9ddcddfe669c
--- /dev/null
+++ b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
@@ -0,0 +1,6 @@
+P3
+30000000000000000000000000000000 1
+255
+103 79 59
+ 95 7P 55
+ 87 67 51
diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx
index e545334b78c6..18b32498eece 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -37,7 +37,7 @@ private:
sal_uLong mnMode; // 0->PBM, 1->PGM, 2->PPM
Bitmap maBmp;
BitmapWriteAccess* mpAcc;
- sal_uLong mnWidth, mnHeight; // dimensions in pixel
+ sal_Int32 mnWidth, mnHeight; // dimensions in pixel
sal_uLong mnCol;
sal_uLong mnMaxVal; // max value in the <missing comment>
bool ImplReadBody();
@@ -83,7 +83,7 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
if ( !( mbStatus = ImplReadHeader() ) )
return false;
- if ( ( mnMaxVal == 0 ) || ( mnWidth == 0 ) || ( mnHeight == 0 ) )
+ if ( ( mnMaxVal == 0 ) || ( mnWidth <= 0 ) || ( mnHeight <= 0 ) )
return false;
// 0->PBM, 1->PGM, 2->PPM
@@ -91,7 +91,8 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
{
case 0 :
maBmp = Bitmap( Size( mnWidth, mnHeight ), 1 );
- if ( ( mpAcc = maBmp.AcquireWriteAccess() ) == 0 )
+ mpAcc = maBmp.AcquireWriteAccess();
+ if (!mpAcc || mpAcc->Width() != mnWidth || mpAcc->Height() != mnHeight)
return false;
mpAcc->SetPaletteEntryCount( 2 );
mpAcc->SetPaletteColor( 0, BitmapColor( 0xff, 0xff, 0xff ) );
@@ -242,8 +243,8 @@ bool PBMReader::ImplReadBody()
bool bPara, bFinished = false;
sal_uInt8 nDat = 0, nCount;
sal_uLong nGrey, nRGB[3];
- sal_uLong nWidth = 0;
- sal_uLong nHeight = 0;
+ sal_Int32 nWidth = 0;
+ sal_Int32 nHeight = 0;
if ( mbRaw )
{