diff options
| author | Christian Lippka ORACLE <christian.lippka@oracle.com> | 2011-01-03 18:04:13 +0100 |
|---|---|---|
| committer | Christian Lippka ORACLE <christian.lippka@oracle.com> | 2011-01-03 18:04:13 +0100 |
| commit | 6c1e2b4e493be845449d5366c28d3c27504329ed (patch) | |
| tree | dd8072fdbcb6d50beac76ecd96d49cf5f296e178 | |
| parent | fdabca4115b0ec69f5e26496b527694ba3913351 (diff) | |
impress208: #164349# fixed possible heap overflow when reading manipulated TGA images
| -rw-r--r-- | filter/source/graphicfilter/itga/itga.cxx | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itga/itga.cxx b/filter/source/graphicfilter/itga/itga.cxx index 5dcb5f82ccab..5f0d3af3cd7f 100644 --- a/filter/source/graphicfilter/itga/itga.cxx +++ b/filter/source/graphicfilter/itga/itga.cxx @@ -338,6 +338,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -360,6 +363,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -387,6 +393,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -407,6 +416,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -440,6 +452,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -457,6 +472,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -483,6 +501,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -500,6 +521,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -528,6 +552,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } @@ -548,6 +575,9 @@ BOOL TGAReader::ImplReadBody() nXCount = 0; nY += nYAdd; nYCount++; + + if( nYCount >= mpFileHeader->nImageHeight ) + return false; // invalid picture } } } |