summaryrefslogtreecommitdiff
path: root/filter
diff options
context:
space:
mode:
authorJulien Nabet <serval2412@yahoo.fr>2013-12-07 19:05:47 +0100
committerEike Rathke <erack@redhat.com>2013-12-11 17:27:36 +0000
commitdd8c33799ecc243f7c3626e8d146e9dbd78b3e09 (patch)
tree69ed5b39059af46e40c6260323475df7cdb3d221 /filter
parentf9f169bd07b2cbaaa9fbe19ec99c07900ee5fbbd (diff)
CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write
Let's be sure that nMaxcolorIndex < 256 Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467 Reviewed-on: https://gerrit.libreoffice.org/6970 Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-on: https://gerrit.libreoffice.org/6971 Reviewed-by: Eike Rathke <erack@redhat.com> Tested-by: Eike Rathke <erack@redhat.com>
Diffstat (limited to 'filter')
-rw-r--r--filter/source/graphicfilter/icgm/class5.cxx15
1 files changed, 7 insertions, 8 deletions
diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx
index c0319b7bc40e..eb537886fbb6 100644
--- a/filter/source/graphicfilter/icgm/class5.cxx
+++ b/filter/source/graphicfilter/icgm/class5.cxx
@@ -316,17 +316,16 @@ void CGM::ImplDoClass5()
if ( nMaxColorIndex > 255 )
{
mbStatus = sal_False;
+ break;
}
- else
- {
- if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
- pElement->nLatestColorMaximumIndex = nMaxColorIndex;
+ if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
+ pElement->nLatestColorMaximumIndex = nMaxColorIndex;
- for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
- {
- pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
- }
+ for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
+ {
+ pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
}
+
pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex;
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{