diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-11-19 09:50:40 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-11-19 11:01:06 +0000 |
| commit | 71f1553cee2c24a4e5b863750e5cfb795b54ecc2 (patch) | |
| tree | 98c07a7520ce334472c9ae1f3a35d1e2a55a7d72 /filter | |
| parent | 885494f4b5e45bde3ecb029796930bfa6741512b (diff) | |
Related: coverity#1242658 Untrusted loop bound
Change-Id: Ic785b333c1ad31036da20483dc7310fcc5338d80
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/ipict/ipict.cxx | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index dec3fc664de9..852e69b7dd68 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -990,7 +990,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo if ( nRowBytes < 8 || nPackType == 1 ) { const size_t nMaxPixels = pPict->remainingSize() / 4; - if (static_cast<size_t>(nHeight) * nWidth > nMaxPixels) + const size_t nMaxRows = nMaxPixels / nWidth; + if (nHeight > nMaxRows) + BITMAPERROR; + const size_t nMaxCols = nMaxPixels / nHeight; + if (nWidth > nMaxCols) BITMAPERROR; for ( ny = 0; ny < nHeight; ny++ ) @@ -1006,7 +1010,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo else if ( nPackType == 2 ) { const size_t nMaxPixels = pPict->remainingSize() / 3; - if (static_cast<size_t>(nHeight) * nWidth > nMaxPixels) + const size_t nMaxRows = nMaxPixels / nWidth; + if (nHeight > nMaxRows) + BITMAPERROR; + const size_t nMaxCols = nMaxPixels / nHeight; + if (nWidth > nMaxCols) BITMAPERROR; for ( ny = 0; ny < nHeight; ny++ ) |