diff options
author | Julien Nabet <serval2412@yahoo.fr> | 2013-12-07 19:05:47 +0100 |
---|---|---|
committer | Eike Rathke <erack@redhat.com> | 2013-12-11 17:27:36 +0000 |
commit | dd8c33799ecc243f7c3626e8d146e9dbd78b3e09 (patch) | |
tree | 69ed5b39059af46e40c6260323475df7cdb3d221 /filter | |
parent | f9f169bd07b2cbaaa9fbe19ec99c07900ee5fbbd (diff) |
CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write
Let's be sure that nMaxcolorIndex < 256
Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467
Reviewed-on: https://gerrit.libreoffice.org/6970
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-on: https://gerrit.libreoffice.org/6971
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
Diffstat (limited to 'filter')
-rw-r--r-- | filter/source/graphicfilter/icgm/class5.cxx | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx index c0319b7bc40e..eb537886fbb6 100644 --- a/filter/source/graphicfilter/icgm/class5.cxx +++ b/filter/source/graphicfilter/icgm/class5.cxx @@ -316,17 +316,16 @@ void CGM::ImplDoClass5() if ( nMaxColorIndex > 255 ) { mbStatus = sal_False; + break; } - else - { - if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex ) - pElement->nLatestColorMaximumIndex = nMaxColorIndex; + if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex ) + pElement->nLatestColorMaximumIndex = nMaxColorIndex; - for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) - { - pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True ); - } + for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) + { + pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True ); } + pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex; for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) { |