diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-14 15:06:32 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-14 21:22:40 +0100 |
| commit | 13fd5d44c1d528c23bcade92241016195c37c453 (patch) | |
| tree | 9203fa8141b95bf7c80af86b5bc1be3ba2799136 /filter | |
| parent | 369018cffb6d1c77e2fb4feec6a4df8a27872ec5 (diff) | |
ofz#6329 Out-of-memory
Change-Id: I42fef1609db1253bcf262ccf3cc86088ea6ca647
Reviewed-on: https://gerrit.libreoffice.org/49739
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ieps/ieps.cxx | 8 | ||||
| -rw-r--r-- | filter/source/graphicfilter/itga/itga.cxx | 2 |
2 files changed, 8 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index a2d94c45faac..e2b5b8e383ab 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -652,7 +652,13 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline - if (pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) + bOk = pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines; + if (bOk) + { + long nResult; + bOk = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3; + } + if (bOk) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) ); diff --git a/filter/source/graphicfilter/itga/itga.cxx b/filter/source/graphicfilter/itga/itga.cxx index 211537f34e67..28cfb8dd25b8 100644 --- a/filter/source/graphicfilter/itga/itga.cxx +++ b/filter/source/graphicfilter/itga/itga.cxx @@ -143,7 +143,7 @@ bool TGAReader::ReadTGA(Graphic & rGraphic) { sal_Size nSize = mpFileHeader->nImageWidth; nSize *= mpFileHeader->nImageHeight; - if (nSize > SAL_MAX_INT32/2) + if (nSize > SAL_MAX_INT32/2/3) return false; mpBitmap.reset( new vcl::bitmap::RawBitmap( Size( mpFileHeader->nImageWidth, mpFileHeader->nImageHeight ) ) ); |