diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-13 12:09:22 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-13 15:38:35 +0100 |
| commit | 7cdbe677c8129005cd596b307b78b23d7443fb90 (patch) | |
| tree | bdd482093ade0532310eaef378f32a92a958b366 /filter | |
| parent | c0522d762d70617aa9a767cdc37a4be82a10c0d4 (diff) | |
ofz#6282 oom Abrt
Change-Id: I35a9681df5a99d51fd3c40d9a4b0a85780c090f2
Reviewed-on: https://gerrit.libreoffice.org/49641
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/iras/iras.cxx | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/iras/iras.cxx b/filter/source/graphicfilter/iras/iras.cxx index 251c3cf480b3..6dca245c2ba3 100644 --- a/filter/source/graphicfilter/iras/iras.cxx +++ b/filter/source/graphicfilter/iras/iras.cxx @@ -167,10 +167,11 @@ bool RASReader::ReadRAS(Graphic & rGraphic) //for the sake of simplicity we'll assume that RAS_TYPE_BYTE_ENCODED can //describe data 255 times larger than the data stored size_t nMaxCompression = mnType != RAS_TYPE_BYTE_ENCODED ? 1 : 255; - if (m_rRAS.remainingSize() * nMaxCompression < static_cast<sal_uInt64>(mnHeight) * mnWidth * mnDepth / 8) - { + sal_uInt32 nBitSize; + if (o3tl::checked_multiply<sal_uInt32>(mnWidth, mnHeight, nBitSize) || o3tl::checked_multiply<sal_uInt32>(nBitSize, mnDepth, nBitSize)) + return false; + if (m_rRAS.remainingSize() * nMaxCompression < nBitSize / 8) return false; - } vcl::bitmap::RawBitmap aBmp(Size(mnWidth, mnHeight)); |