From dd8c33799ecc243f7c3626e8d146e9dbd78b3e09 Mon Sep 17 00:00:00 2001 From: Julien Nabet Date: Sat, 7 Dec 2013 19:05:47 +0100 Subject: CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's be sure that nMaxcolorIndex < 256 Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467 Reviewed-on: https://gerrit.libreoffice.org/6970 Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara Reviewed-on: https://gerrit.libreoffice.org/6971 Reviewed-by: Eike Rathke Tested-by: Eike Rathke --- filter/source/graphicfilter/icgm/class5.cxx | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to 'filter') diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx index c0319b7bc40e..eb537886fbb6 100644 --- a/filter/source/graphicfilter/icgm/class5.cxx +++ b/filter/source/graphicfilter/icgm/class5.cxx @@ -316,17 +316,16 @@ void CGM::ImplDoClass5() if ( nMaxColorIndex > 255 ) { mbStatus = sal_False; + break; } - else - { - if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex ) - pElement->nLatestColorMaximumIndex = nMaxColorIndex; + if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex ) + pElement->nLatestColorMaximumIndex = nMaxColorIndex; - for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) - { - pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True ); - } + for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) + { + pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True ); } + pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex; for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) { -- cgit v1.2.3