diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2012-04-17 16:45:23 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2012-04-17 16:46:14 +0100 |
| commit | 9ff94ae0fa947c5fd6a31fbc38421f60eb5e1fba (patch) | |
| tree | 002b55a59e8a5a7b851adfbd2edad17ca509b67f /basebmp | |
| parent | b1bee56af9a4cbbaabfe43290d28f53efdebc14d (diff) | |
png parsing regression test
Diffstat (limited to 'basebmp')
| -rw-r--r-- | basebmp/source/bitmapdevice.cxx | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/basebmp/source/bitmapdevice.cxx b/basebmp/source/bitmapdevice.cxx index 1586fce1cfb5..b3676c603edc 100644 --- a/basebmp/source/bitmapdevice.cxx +++ b/basebmp/source/bitmapdevice.cxx @@ -1881,8 +1881,16 @@ BitmapDeviceSharedPtr createBitmapDeviceImpl( const basegfx::B2IVector& // factor in bottom-up scanline order case nScanlineStride *= bTopDown ? 1 : -1; - const std::size_t nMemSize( - (nScanlineStride < 0 ? -nScanlineStride : nScanlineStride)*rSize.getY() ); + const sal_uInt32 nWidth(nScanlineStride < 0 ? -nScanlineStride : nScanlineStride); + const sal_uInt32 nHeight(rSize.getY()); + + if (nHeight && nWidth && nWidth > SAL_MAX_INT32 / nHeight) + { + SAL_WARN( "basebmp", "suspicious massive alloc " << nWidth << " * " << nHeight); + return BitmapDeviceSharedPtr(); + } + + const std::size_t nMemSize(nWidth * nHeight); if( !pMem ) { |