diff options
| author | David Tardon <dtardon@redhat.com> | 2016-01-22 15:14:00 +0100 |
|---|---|---|
| committer | Miklos Vajna <vmiklos@collabora.co.uk> | 2016-01-29 13:27:21 +0000 |
| commit | 04fdf5bb667f8425228fa5df69236a4728808ab2 (patch) | |
| tree | 76d3503325c8ddb94a80496457ab9740e8957d3e /vcl | |
| parent | 5fc827d2d0289d178d227161976eb05117853af9 (diff) | |
sanitize value
Change-Id: I0dfde2343263251a6b3034736c5c7219c5e130e4
(cherry picked from commit 55141ac82950aaa289fd5ec9957800030fcdba0c)
Reviewed-on: https://gerrit.libreoffice.org/21786
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/gdi/dibtools.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx index 030cf5792c73..8cfc6305c1fe 100644 --- a/vcl/source/gdi/dibtools.cxx +++ b/vcl/source/gdi/dibtools.cxx @@ -824,6 +824,8 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, Bitmap* pBmpAlpha, sal_uLon // read coding information rIStm.ReadUInt32( nCodedSize ).ReadUInt32( nUncodedSize ).ReadUInt32( aHeader.nCompression ); + if (nCodedSize > rIStm.remainingSize()) + nCodedSize = sal_uInt32(rIStm.remainingSize()); pData = static_cast<sal_uInt8*>(rtl_allocateMemory( nUncodedSize )); // decode buffer |