mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

coverity#1242658 Untrusted loop bound

Browse Source 
Change-Id: I0a279e47a4d87f561f39d5a8ca65fa17e2bc4a65
This commit is contained in:
Caolán McNamara
2015-09-29 10:39:54 +01:00
parent 6a0adc9aea
commit 97a2ca5d68
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
filter/source/graphicfilter/ipict/ipict.cxx
View File

@@ -84,16 +84,15 @@ namespace PictReaderInternal {
};
sal_uLong Pattern::read(SvStream &stream) {
short nx,ny;
unsigned char nbyte[8];
sal_uLong nHiBytes, nLoBytes;
isColor = false;
// count the no of bits in pattern which are set to 1:
nBitCount=0;
for (ny=0; ny<8; ny++) {
for (short ny=0; ny<8; ny++) {
stream.ReadChar( reinterpret_cast<char&>(nbyte[ny]) );
for (nx=0; nx<8; nx++) {
for (short nx=0; nx<8; nx++) {
if ( (nbyte[ny] & (1<<nx)) != 0 ) nBitCount++;
}
}
@@ -706,7 +705,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
Bitmap aBitmap;
BitmapWriteAccess* pAcc = NULL;
BitmapReadAccess* pReadAcc = NULL;
sal_uInt16 ny, nx, nColTabSize;
sal_uInt16 nColTabSize;
sal_uInt16 nRowBytes, nBndX, nBndY, nWidth, nHeight, nVersion, nPackType, nPixelType,
nPixelSize, nCmpCount, nCmpSize;
sal_uInt32 nPackSize, nPlaneBytes, nHRes, nVRes;
@@ -835,9 +834,14 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if ( nRowBytes < nSrcBPL || nRowBytes > nDestBPL )
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ )
if ( nRowBytes < 8 || nPackType == 1 ) {
if (pPict->remainingSize() < sizeof(sal_uInt8) * nHeight * nRowBytes)
BITMAPERROR;
}
for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
{
nx = 0;
sal_uInt16 nx = 0;
if ( nRowBytes < 8 || nPackType == 1 )
{
for ( i = 0; i < nRowBytes; i++ )
@@ -908,9 +912,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
BITMAPERROR;
}
for ( ny = 0; ny < nHeight; ny++ )
for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
{
nx = 0;
sal_uInt16 nx = 0;
if ( nRowBytes < 8 || nPackType == 1 )
{
for ( i = 0; i < nWidth; i++ )
@@ -1005,9 +1009,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if (nWidth > nMaxCols)
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ )
for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
{
for ( nx = 0; nx < nWidth; nx++ )
for (sal_uInt16 nx = 0; nx < nWidth; ++nx)
{
pPict->ReadUChar( nDummy ).ReadUChar( nRed ).ReadUChar( nGreen ).ReadUChar( nBlue );
pAcc->SetPixel( ny, nx, BitmapColor( nRed, nGreen, nBlue) );
@@ -1025,9 +1029,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if (nWidth > nMaxCols)
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ )
for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
{
for ( nx = 0; nx < nWidth; nx++ )
for (sal_uInt16 nx = 0; nx < nWidth; ++nx)
{
pPict->ReadUChar( nRed ).ReadUChar( nGreen ).ReadUChar( nBlue );
pAcc->SetPixel( ny, nx, BitmapColor( nRed, nGreen, nBlue ) );
@@ -1040,7 +1044,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) )
{
std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
for ( ny = 0; ny < nHeight; ny++ )
for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
{
nSrcBitsPos = pPict->Tell();
if ( nRowBytes > 250 )
@@ -1086,7 +1090,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
sal_uInt8* pTmp = pScanline.get();
if ( nCmpCount == 4 )
pTmp += nWidth;
for ( nx = 0; nx < nWidth; pTmp++ )
for (sal_uInt16 nx = 0; nx < nWidth; pTmp++)
pAcc->SetPixel( ny, nx++, BitmapColor( *pTmp, pTmp[ nWidth ], pTmp[ 2 * nWidth ] ) );
nDataSize += (sal_uLong)nByteCount;
pPict->Seek( nSrcBitsPos + (sal_uLong)nByteCount );