From 3cbe00474c373f21b5793915c4919e5c277d2c01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Fri, 23 Dec 2016 18:44:47 +0000
Subject: [PATCH] Related: ofz#318 limit bitmap max to SAL_MAX_INT32

Change-Id: Iae8a0782e5c306f619e0d94a60dfa0d7c00ec54e
---
 vcl/headless/svpbmp.cxx | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx
index 10a45967cee0..e7d367a75929 100644
--- a/vcl/headless/svpbmp.cxx
+++ b/vcl/headless/svpbmp.cxx
@@ -121,9 +121,15 @@ BitmapBuffer* ImplCreateDIB(
         pDIB->maPalette.SetEntryCount( nColors );
     }
 
+    size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
+    if (size > SAL_MAX_INT32)
+    {
+        delete pDIB;
+        return nullptr;
+    }
+
     try
     {
-        size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
         pDIB->mpBits = new sal_uInt8[size];
 #ifdef __SANITIZE_ADDRESS__
         if (!pDIB->mpBits)