diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-24 20:43:37 +0100 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2015-08-25 07:49:25 +0000 |
| commit | 25418bf4997e3f1b31e0da87ee0947ad9c8da2ce (patch) | |
| tree | f2f64ebd11fcfd299781c8bd1beb6bc2573894f9 /filter | |
| parent | 436ccb0df15c1c654e5b3eebfd3ba94ddd2341c5 (diff) | |
in reality we are limited to max sal_Int32 here
so accept that and test if the values were accepted or limited
Change-Id: Iaed5ebc2f12b52055506147c71117a2ad88d28ac
(cherry picked from commit 0a76c1fd6875bd094ebe2bfbed3d01c98dc0c19e)
Reviewed-on: https://gerrit.libreoffice.org/17972
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/qa/cppunit/data/pbm/fail/crash-1.pbm | 6 | ||||
| -rw-r--r-- | filter/source/graphicfilter/ipbm/ipbm.cxx | 11 |
2 files changed, 12 insertions, 5 deletions
diff --git a/filter/qa/cppunit/data/pbm/fail/crash-1.pbm b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm new file mode 100644 index 000000000000..9ddcddfe669c --- /dev/null +++ b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm @@ -0,0 +1,6 @@ +P3 +30000000000000000000000000000000 1 +255 +103 79 59 + 95 7P 55 + 87 67 51 diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx index e545334b78c6..18b32498eece 100644 --- a/filter/source/graphicfilter/ipbm/ipbm.cxx +++ b/filter/source/graphicfilter/ipbm/ipbm.cxx @@ -37,7 +37,7 @@ private: sal_uLong mnMode; // 0->PBM, 1->PGM, 2->PPM Bitmap maBmp; BitmapWriteAccess* mpAcc; - sal_uLong mnWidth, mnHeight; // dimensions in pixel + sal_Int32 mnWidth, mnHeight; // dimensions in pixel sal_uLong mnCol; sal_uLong mnMaxVal; // max value in the <missing comment> bool ImplReadBody(); @@ -83,7 +83,7 @@ bool PBMReader::ReadPBM(Graphic & rGraphic ) if ( !( mbStatus = ImplReadHeader() ) ) return false; - if ( ( mnMaxVal == 0 ) || ( mnWidth == 0 ) || ( mnHeight == 0 ) ) + if ( ( mnMaxVal == 0 ) || ( mnWidth <= 0 ) || ( mnHeight <= 0 ) ) return false; // 0->PBM, 1->PGM, 2->PPM @@ -91,7 +91,8 @@ bool PBMReader::ReadPBM(Graphic & rGraphic ) { case 0 : maBmp = Bitmap( Size( mnWidth, mnHeight ), 1 ); - if ( ( mpAcc = maBmp.AcquireWriteAccess() ) == 0 ) + mpAcc = maBmp.AcquireWriteAccess(); + if (!mpAcc || mpAcc->Width() != mnWidth || mpAcc->Height() != mnHeight) return false; mpAcc->SetPaletteEntryCount( 2 ); mpAcc->SetPaletteColor( 0, BitmapColor( 0xff, 0xff, 0xff ) ); @@ -242,8 +243,8 @@ bool PBMReader::ImplReadBody() bool bPara, bFinished = false; sal_uInt8 nDat = 0, nCount; sal_uLong nGrey, nRGB[3]; - sal_uLong nWidth = 0; - sal_uLong nHeight = 0; + sal_Int32 nWidth = 0; + sal_Int32 nHeight = 0; if ( mbRaw ) { |