diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-01-09 16:07:32 +0000 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2022-01-12 11:13:45 +0100 |
| commit | 8165325a4365801c7a0db9f146c14defd202eae9 (patch) | |
| tree | 11e76396c2eb199c3a6ebe6cefbf7ff6c9028011 | |
| parent | 7958bc52521ad17c697326cf129f414bec1b2b42 (diff) | |
ofz#43446 Undefined-shift
Change-Id: Ibe3485983ecf764ca8b8e667b470c6b210b6d2d4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128192
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 27e9de358b4afc6a89b09c173316cee0abfb471d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128233
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 9789d97a9c57..ac0c9879e18b 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1337,6 +1337,22 @@ LwpDrawBitmap::~LwpDrawBitmap() { } +static bool IsValid(const BmpInfoHeader2& rHeader) +{ + if (rHeader.nPlanes != 1) + return false; + + if (rHeader.nBitCount != 0 && rHeader.nBitCount != 1 && + rHeader.nBitCount != 4 && rHeader.nBitCount != 8 && + rHeader.nBitCount != 16 && rHeader.nBitCount != 24 && + rHeader.nBitCount != 32) + { + return false; + } + + return true; +} + /** * @descr reading function of class LwpDrawBitmap */ @@ -1363,6 +1379,9 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); + if (!IsValid(aInfoHeader2)) + throw BadRead(); + N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; if (N == 24) { @@ -1379,6 +1398,10 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt32( aInfoHeader2.nHeight ); m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); + + if (!IsValid(aInfoHeader2)) + throw BadRead(); + N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; if (N == 24) { |