Related: ofz#318 limit bitmap max to SAL_MAX_INT32

Change-Id: Iae8a0782e5c306f619e0d94a60dfa0d7c00ec54e
2016-12-23 18:44:47 +00:00
parent 036c1f445a
commit 3cbe00474c
1 changed files with 7 additions and 1 deletions
--- a/vcl/headless/svpbmp.cxx
+++ b/vcl/headless/svpbmp.cxx
@@ -121,9 +121,15 @@ BitmapBuffer* ImplCreateDIB(
        pDIB->maPalette.SetEntryCount( nColors );
    }

+    size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
+    if (size > SAL_MAX_INT32)
+    {
+        delete pDIB;
+        return nullptr;
+    }
+
    try
    {
-        size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
        pDIB->mpBits = new sal_uInt8[size];
 #ifdef __SANITIZE_ADDRESS__
        if (!pDIB->mpBits)