[Libreoffice-commits] core.git: basebmp/source

[Caolán McNamara]

 basebmp/source/bitmapdevice.cxx |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

New commits:
commit 35412949a2fb2a4472177a0289de4f0c062b674d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 28 09:23:03 2014 +0100

    keep nScanlineStride number sane
    
    bff + valgrind
    
    Change-Id: I255a052251a6a0f1e4005b9cfb3b6ce00c6653ee

diff --git a/basebmp/source/bitmapdevice.cxx b/basebmp/source/bitmapdevice.cxx
index bf3de07..4104c18 100644
--- a/basebmp/source/bitmapdevice.cxx
+++ b/basebmp/source/bitmapdevice.cxx
@@ -1952,12 +1952,15 @@ BitmapDeviceSharedPtr createBitmapDeviceImplInner( const basegfx::B2IVector&
         nScanlineFormat >  FORMAT_MAX )
         return BitmapDeviceSharedPtr();
 
-
-
-    sal_Int32  nScanlineStride(0);
-
+    sal_uInt8 nBitsPerPixel = bitsPerPixel[nScanlineFormat];
+    if (rSize.getX() > (SAL_MAX_INT32-7) / nBitsPerPixel)
+    {
+        SAL_WARN("basebmp", "suspicious bitmap width " <<
+                 rSize.getX() << " for depth " << nBitsPerPixel);
+        return BitmapDeviceSharedPtr();
+    }
     // round up to full 8 bit, divide by 8
-    nScanlineStride = (rSize.getX()*bitsPerPixel[nScanlineFormat] + 7) >> 3;
+    sal_Int32 nScanlineStride = (rSize.getX()*nBitsPerPixel + 7) >> 3;
 
     // rounded up to next full power-of-two number of bytes
     const sal_uInt32 bytesPerPixel = nextPow2(