[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/ras/fail/crash-1.ras |binary
 filter/source/graphicfilter/iras/iras.cxx   |   18 +++++++++---------
 2 files changed, 9 insertions(+), 9 deletions(-)

New commits:
commit 28df6b2e6eba0f9d3ee1ddc1e0425561957294e1
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jul 15 11:02:13 2015 +0100

    file format documentation states these are signed
    
    Change-Id: Iaca58dda19d24a767333ff642759414951a03e6d
    (cherry picked from commit 8a60e78769ebf6fc73ddc8ed7e43991fcb30fff4)
    Reviewed-on: https://gerrit.libreoffice.org/17065
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/qa/cppunit/data/ras/fail/crash-1.ras b/filter/qa/cppunit/data/ras/fail/crash-1.ras
new file mode 100644
index 0000000..d1abbae
Binary files /dev/null and b/filter/qa/cppunit/data/ras/fail/crash-1.ras differ
diff --git a/filter/source/graphicfilter/iras/iras.cxx b/filter/source/graphicfilter/iras/iras.cxx
index 91d279b..2f441cf 100644
--- a/filter/source/graphicfilter/iras/iras.cxx
+++ b/filter/source/graphicfilter/iras/iras.cxx
@@ -44,12 +44,12 @@ private:
 
     bool                mbStatus;
     Bitmap              maBmp;
-    sal_uInt32          mnWidth, mnHeight;      // Bildausmass in Pixeln
-    sal_uInt16              mnDstBitsPerPix;
-    sal_uInt16              mnDstColors;
-    sal_uInt32          mnDepth, mnImageDatSize, mnType;
-    sal_uInt32          mnColorMapType, mnColorMapSize;
-    sal_uInt8               mnRepCount, mnRepVal;   // RLE Decoding
+    sal_Int32           mnWidth, mnHeight;      // Bildausmass in Pixeln
+    sal_uInt16          mnDstBitsPerPix;
+    sal_uInt16          mnDstColors;
+    sal_Int32           mnDepth, mnImageDatSize, mnType;
+    sal_Int32           mnColorMapType, mnColorMapSize;
+    sal_uInt8           mnRepCount, mnRepVal;   // RLE Decoding
     bool                mbPalette;
 
     bool                ImplReadBody(BitmapWriteAccess * pAcc);
@@ -178,9 +178,9 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
 
 bool RASReader::ImplReadHeader()
 {
-    m_rRAS.ReadUInt32( mnWidth ).ReadUInt32( mnHeight ).ReadUInt32( mnDepth ).ReadUInt32( mnImageDatSize ).        ReadUInt32( mnType ).ReadUInt32( mnColorMapType ).ReadUInt32( mnColorMapSize );
+    m_rRAS.ReadInt32(mnWidth).ReadInt32(mnHeight).ReadInt32(mnDepth).ReadInt32(mnImageDatSize).ReadInt32(mnType).ReadInt32(mnColorMapType).ReadInt32(mnColorMapSize);
 
-    if ( mnWidth == 0 || mnHeight == 0 )
+    if ( mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0 )
         mbStatus = false;
 
     switch ( mnDepth )
@@ -216,7 +216,7 @@ bool RASReader::ImplReadHeader()
 
 bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
 {
-    sal_uLong   x, y;
+    sal_Int32 x, y;
     sal_uInt8   nDat = 0;
     sal_uInt8    nRed, nGreen, nBlue;
     switch ( mnDstBitsPerPix )