summaryrefslogtreecommitdiff
path: root/vcl
diff options
context:
space:
mode:
authorDavid Tardon <dtardon@redhat.com>2016-01-22 15:14:00 +0100
committerMiklos Vajna <vmiklos@collabora.co.uk>2016-01-29 13:27:21 +0000
commit04fdf5bb667f8425228fa5df69236a4728808ab2 (patch)
tree76d3503325c8ddb94a80496457ab9740e8957d3e /vcl
parent5fc827d2d0289d178d227161976eb05117853af9 (diff)
sanitize value
Change-Id: I0dfde2343263251a6b3034736c5c7219c5e130e4 (cherry picked from commit 55141ac82950aaa289fd5ec9957800030fcdba0c) Reviewed-on: https://gerrit.libreoffice.org/21786 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Diffstat (limited to 'vcl')
-rw-r--r--vcl/source/gdi/dibtools.cxx2
1 files changed, 2 insertions, 0 deletions
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index 030cf5792c73..8cfc6305c1fe 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -824,6 +824,8 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, Bitmap* pBmpAlpha, sal_uLon
// read coding information
rIStm.ReadUInt32( nCodedSize ).ReadUInt32( nUncodedSize ).ReadUInt32( aHeader.nCompression );
+ if (nCodedSize > rIStm.remainingSize())
+ nCodedSize = sal_uInt32(rIStm.remainingSize());
pData = static_cast<sal_uInt8*>(rtl_allocateMemory( nUncodedSize ));
// decode buffer