summaryrefslogtreecommitdiff
path: root/filter/source/graphicfilter/itga/itga.cxx
diff options
context:
space:
mode:
authorChristian Lippka ORACLE <christian.lippka@oracle.com>2011-01-03 18:04:13 +0100
committerChristian Lippka ORACLE <christian.lippka@oracle.com>2011-01-03 18:04:13 +0100
commit6c1e2b4e493be845449d5366c28d3c27504329ed (patch)
treedd8072fdbcb6d50beac76ecd96d49cf5f296e178 /filter/source/graphicfilter/itga/itga.cxx
parentfdabca4115b0ec69f5e26496b527694ba3913351 (diff)
impress208: #164349# fixed possible heap overflow when reading manipulated TGA images
Diffstat (limited to 'filter/source/graphicfilter/itga/itga.cxx')
-rw-r--r--filter/source/graphicfilter/itga/itga.cxx30
1 files changed, 30 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itga/itga.cxx b/filter/source/graphicfilter/itga/itga.cxx
index 5dcb5f82ccab..5f0d3af3cd7f 100644
--- a/filter/source/graphicfilter/itga/itga.cxx
+++ b/filter/source/graphicfilter/itga/itga.cxx
@@ -338,6 +338,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -360,6 +363,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -387,6 +393,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -407,6 +416,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -440,6 +452,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -457,6 +472,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -483,6 +501,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -500,6 +521,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -528,6 +552,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -548,6 +575,9 @@ BOOL TGAReader::ImplReadBody()
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}