diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-17 12:35:24 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-01-26 16:26:49 +0000 |
| commit | b7b125d4a1880df5616f2b9b013775095d3a3d35 (patch) | |
| tree | ab913199b5df6565e2a2983203e8190b9e59d1c1 | |
| parent | bdf5f1d7fc8bade23c55009922d8d471c8670063 (diff) | |
ofz#411: XPMReader::ImplGetColKey short read
Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
Reviewed-on: https://gerrit.libreoffice.org/33217
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit caa24065bc0436cde5aa5bd5de4f76c65b1933f0)
Reviewed-on: https://gerrit.libreoffice.org/33540
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Reviewed-by: Eike Rathke <erack@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | vcl/source/filter/ixpm/xpmread.cxx | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/vcl/source/filter/ixpm/xpmread.cxx b/vcl/source/filter/ixpm/xpmread.cxx index 3d222584df96..6aaaa1c828ee 100644 --- a/vcl/source/filter/ixpm/xpmread.cxx +++ b/vcl/source/filter/ixpm/xpmread.cxx @@ -66,7 +66,7 @@ private: sal_uLong mnWidth; sal_uLong mnHeight; sal_uLong mnColors; - sal_uLong mnCpp; // characters per pix + sal_uInt32 mnCpp; // characters per pix bool mbTransparent; bool mbStatus; sal_uLong mnStatus; @@ -305,9 +305,12 @@ bool XPMReader::ImplGetColor( sal_uLong nNumb ) sal_uInt8* pPtr = ( mpColMap + nNumb * ( 4 + mnCpp ) ); bool bStatus = ImplGetString(); - if ( bStatus ) + if (bStatus && mnStringSize < mnCpp) + bStatus = false; + + if (bStatus) { - for ( sal_uLong i = 0; i < mnCpp; i++ ) + for (sal_uInt32 i = 0; i < mnCpp; ++i) *pPtr++ = *pString++; bStatus = ImplGetColSub ( pPtr ); } |