[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/pbm/fail/crash-1.pbm |    6 ++++++
 filter/source/graphicfilter/ipbm/ipbm.cxx   |   11 ++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

New commits:
commit 84df27c093b4a52df92bef570cde96dcebdf35c9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 24 20:43:37 2015 +0100

    in reality we are limited to max sal_Int32 here
    
    so accept that and test if the values were accepted or limited
    
    Change-Id: Iaed5ebc2f12b52055506147c71117a2ad88d28ac
    (cherry picked from commit 0a76c1fd6875bd094ebe2bfbed3d01c98dc0c19e)
    Reviewed-on: https://gerrit.libreoffice.org/17973
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/qa/cppunit/data/pbm/fail/crash-1.pbm b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
new file mode 100644
index 0000000..9ddcddf
--- /dev/null
+++ b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
@@ -0,0 +1,6 @@
+P3
+30000000000000000000000000000000 1
+255
+103  79  59
+ 95  7P  55
+ 87  67  51
diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx
index 720bc9f..231b0e6 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -37,7 +37,7 @@ private:
     sal_uLong           mnMode;             // 0->PBM, 1->PGM, 2->PPM
     Bitmap              maBmp;
     BitmapWriteAccess*  mpAcc;
-    sal_uLong           mnWidth, mnHeight;  // dimensions in pixel
+    sal_Int32       mnWidth, mnHeight;  // dimensions in pixel
     sal_uLong           mnCol;
     sal_uLong           mnMaxVal;           // max value in the <missing comment>
     bool            ImplCallback( sal_uInt16 nPercent );
@@ -99,7 +99,7 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     if ( ( mbStatus = ImplReadHeader() ) == false )
         return false;
 
-    if ( ( mnMaxVal == 0 ) || ( mnWidth == 0 ) || ( mnHeight == 0 ) )
+    if ( ( mnMaxVal == 0 ) || ( mnWidth <= 0 ) || ( mnHeight <= 0 ) )
         return false;
 
     // 0->PBM, 1->PGM, 2->PPM
@@ -107,7 +107,8 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     {
         case 0 :
             maBmp = Bitmap( Size( mnWidth, mnHeight ), 1 );
-            if ( ( mpAcc = maBmp.AcquireWriteAccess() ) == 0 )
+            mpAcc = maBmp.AcquireWriteAccess();
+            if (!mpAcc || mpAcc->Width() != mnWidth || mpAcc->Height() != mnHeight)
                 return false;
             mpAcc->SetPaletteEntryCount( 2 );
             mpAcc->SetPaletteColor( 0, BitmapColor( 0xff, 0xff, 0xff ) );
@@ -258,8 +259,8 @@ bool PBMReader::ImplReadBody()
     bool    bPara, bFinished = false;
     sal_uInt8   nDat = 0, nCount;
     sal_uLong   nGrey, nRGB[3];
-    sal_uLong   nWidth = 0;
-    sal_uLong   nHeight = 0;
+    sal_Int32 nWidth = 0;
+    sal_Int32 nHeight = 0;
 
     if ( mbRaw )
     {