diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-02 19:22:19 +0100 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2017-06-06 15:00:41 +0200 |
| commit | e5a25e6b01490cf14dfc6af019fdb0896b19a76d (patch) | |
| tree | 4fe042bf57ae56d13223afeef0f7d81acd993adc | |
| parent | 75d14731e79b66a75e2d3327b94721f6218eb4d7 (diff) | |
ofz: fix remaining length check
Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
Reviewed-on: https://gerrit.libreoffice.org/38363
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
| -rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index fecad6b73d75..817a0efada76 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -636,15 +636,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); |