[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - filter/source

[Julien Nabet]

 filter/source/graphicfilter/icgm/class5.cxx |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

New commits:
commit 74f181d285425bf7ec2ec8a18ad9f2e075f52594
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Sat Dec 7 19:05:47 2013 +0100

    CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write
    
    Let's be sure that nMaxcolorIndex < 256
    
    Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467
    Reviewed-on: https://gerrit.libreoffice.org/6970
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    Reviewed-on: https://gerrit.libreoffice.org/6972

diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx
index c0319b7..eb53788 100644
--- a/filter/source/graphicfilter/icgm/class5.cxx
+++ b/filter/source/graphicfilter/icgm/class5.cxx
@@ -316,17 +316,16 @@ void CGM::ImplDoClass5()
                     if ( nMaxColorIndex > 255 )
                     {
                         mbStatus = sal_False;
+                        break;
                     }
-                    else
-                    {
-                        if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
-                            pElement->nLatestColorMaximumIndex = nMaxColorIndex;
+                    if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
+                        pElement->nLatestColorMaximumIndex = nMaxColorIndex;
 
-                        for (  nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
-                        {
-                            pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
-                        }
+                    for (  nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
+                    {
+                        pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
                     }
+
                     pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex;
                     for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
                     {