mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

check data needed to fulfil ras claims before allocating

Browse Source 
Change-Id: Ifdd820e4ea4287f97cc07cb86c0a180d06081449
This commit is contained in:
Caolán McNamara
2017-02-14 11:33:44 +00:00
parent 5e4fb24278
commit dfc58d2db7
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
filter/source/graphicfilter/iras/iras.cxx
View File

@@ -168,6 +168,14 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
if (!bOk) if (!bOk)
return false; return false;
if (mnType != RAS_TYPE_BYTE_ENCODED) //simple raw format
{
if (m_rRAS.remainingSize() < static_cast<sal_uInt64>(mnHeight) * mnWidth * mnDepth / 8)
{
return false;
}
}
Bitmap aBmp(Size(mnWidth, mnHeight), mnDstBitsPerPix); Bitmap aBmp(Size(mnWidth, mnHeight), mnDstBitsPerPix);
Bitmap::ScopedWriteAccess pAcc(aBmp); Bitmap::ScopedWriteAccess pAcc(aBmp);
if (pAcc == nullptr) if (pAcc == nullptr)
@@ -178,6 +186,7 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
pAcc->SetPalette(aPalette); pAcc->SetPalette(aPalette);
} }
// Bitmap-Daten einlesen // Bitmap-Daten einlesen
mbStatus = ImplReadBody(pAcc.get()); mbStatus = ImplReadBody(pAcc.get());
@@ -191,7 +200,7 @@ bool RASReader::ImplReadHeader()
{ {
m_rRAS.ReadInt32(mnWidth).ReadInt32(mnHeight).ReadInt32(mnDepth).ReadInt32(mnImageDatSize).ReadInt32(mnType).ReadInt32(mnColorMapType).ReadInt32(mnColorMapSize); m_rRAS.ReadInt32(mnWidth).ReadInt32(mnHeight).ReadInt32(mnDepth).ReadInt32(mnImageDatSize).ReadInt32(mnType).ReadInt32(mnColorMapType).ReadInt32(mnColorMapSize);
if (mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0 || !m_rRAS.good()) if (!m_rRAS.good() || mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0)
mbStatus = false; mbStatus = false;
switch ( mnDepth ) switch ( mnDepth )
@@ -223,7 +232,6 @@ bool RASReader::ImplReadHeader()
return mbStatus; return mbStatus;
} }
bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc) bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
{ {
sal_Int32 x, y; sal_Int32 x, y;