diff options
author | David Tardon <dtardon@redhat.com> | 2016-01-22 15:14:00 +0100 |
---|---|---|
committer | David Tardon <dtardon@redhat.com> | 2016-01-24 16:55:19 +0100 |
commit | 55141ac82950aaa289fd5ec9957800030fcdba0c (patch) | |
tree | 706d93c5da0a0ebe11afdda2dd0396a3ce06ae51 /vcl/source/gdi | |
parent | 4d67b0baaa4f0fb009b9ee6fbcf4618abf009f53 (diff) |
sanitize value
Change-Id: I0dfde2343263251a6b3034736c5c7219c5e130e4
Diffstat (limited to 'vcl/source/gdi')
-rw-r--r-- | vcl/source/gdi/dibtools.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx index e5b67fa6000c..ede4c5572009 100644 --- a/vcl/source/gdi/dibtools.cxx +++ b/vcl/source/gdi/dibtools.cxx @@ -835,6 +835,8 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, Bitmap* pBmpAlpha, sal_uLon // read coding information rIStm.ReadUInt32( nCodedSize ).ReadUInt32( nUncodedSize ).ReadUInt32( aHeader.nCompression ); + if (nCodedSize > rIStm.remainingSize()) + nCodedSize = sal_uInt32(rIStm.remainingSize()); pData = static_cast<sal_uInt8*>(rtl_allocateMemory( nUncodedSize )); // decode buffer |