summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2017-06-17 21:16:34 +0100
committerEike Rathke <erack@redhat.com>2017-06-22 00:03:32 +0200
commit67caad3c98d045b8de3e4bf2f63efda2e9d8cc48 (patch)
treeaf59f0edebe7a2d530e187ce9ea428d005ec8a5e
parentd185c58fcf8d7b82bc84b16b56020c3fbaf2a876 (diff)
ofz#2287 check multiply
Change-Id: Ibc4c93ac1f5686a476b5e303347dc951daa58e33 Reviewed-on: https://gerrit.libreoffice.org/38911 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Eike Rathke <erack@redhat.com>
-rw-r--r--vcl/headless/svpbmp.cxx10
1 files changed, 9 insertions, 1 deletions
diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx
index 71c5e52586c6..02aa41b66bc5 100644
--- a/vcl/headless/svpbmp.cxx
+++ b/vcl/headless/svpbmp.cxx
@@ -135,7 +135,15 @@ BitmapBuffer* ImplCreateDIB(
try
{
- size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
+ size_t size;
+ bFail = o3tl::checked_multiply<size_t>(pDIB->mnHeight, pDIB->mnScanlineSize, size);
+ SAL_WARN_IF(bFail, "vcl.gdi", "checked multiply failed");
+ if (bFail)
+ {
+ delete pDIB;
+ return nullptr;
+ }
+
pDIB->mpBits = new sal_uInt8[size];
#ifdef __SANITIZE_ADDRESS__
if (!pDIB->mpBits)