diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-08-28 09:23:03 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-08-28 09:24:17 +0100 |
| commit | 35412949a2fb2a4472177a0289de4f0c062b674d (patch) | |
| tree | 9b922ed12e4afa0716cc6d6a33885822eb90627e | |
| parent | 80748411462c20d51d80eca63211285036af106c (diff) | |
keep nScanlineStride number sane
bff + valgrind
Change-Id: I255a052251a6a0f1e4005b9cfb3b6ce00c6653ee
| -rw-r--r-- | basebmp/source/bitmapdevice.cxx | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/basebmp/source/bitmapdevice.cxx b/basebmp/source/bitmapdevice.cxx index bf3de07a80eb..4104c186cdf5 100644 --- a/basebmp/source/bitmapdevice.cxx +++ b/basebmp/source/bitmapdevice.cxx @@ -1952,12 +1952,15 @@ BitmapDeviceSharedPtr createBitmapDeviceImplInner( const basegfx::B2IVector& nScanlineFormat > FORMAT_MAX ) return BitmapDeviceSharedPtr(); - - - sal_Int32 nScanlineStride(0); - + sal_uInt8 nBitsPerPixel = bitsPerPixel[nScanlineFormat]; + if (rSize.getX() > (SAL_MAX_INT32-7) / nBitsPerPixel) + { + SAL_WARN("basebmp", "suspicious bitmap width " << + rSize.getX() << " for depth " << nBitsPerPixel); + return BitmapDeviceSharedPtr(); + } // round up to full 8 bit, divide by 8 - nScanlineStride = (rSize.getX()*bitsPerPixel[nScanlineFormat] + 7) >> 3; + sal_Int32 nScanlineStride = (rSize.getX()*nBitsPerPixel + 7) >> 3; // rounded up to next full power-of-two number of bytes const sal_uInt32 bytesPerPixel = nextPow2( |