diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-06-02 19:22:19 +0100 |
|---|---|---|
| committer | Michael Stahl <Michael.Stahl@cib.de> | 2019-08-01 15:32:38 +0200 |
| commit | 0b25e64ea50346cf4b4cbaad1ccc4ab98b79ba8f (patch) | |
| tree | 752b8fe9837915e786bae3b0be68f3af87774ce8 /filter | |
| parent | 1404c0babc8d3ced251eadbbc783d629ffb29397 (diff) | |
ofz: fix remaining length check
Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
Reviewed-on: https://gerrit.libreoffice.org/38362
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 3b96a1690c617f53844925e105f36e138e7e3d56)
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index e1fa24c8c385..e7857844c2f3 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -637,15 +637,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); |