[Libreoffice-commits] core.git: Branch 'libreoffice-5-1' - vcl/source

[David Tardon]

 vcl/source/gdi/dibtools.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 04fdf5bb667f8425228fa5df69236a4728808ab2
Author: David Tardon <dtardon at redhat.com>
Date:   Fri Jan 22 15:14:00 2016 +0100

    sanitize value
    
    Change-Id: I0dfde2343263251a6b3034736c5c7219c5e130e4
    (cherry picked from commit 55141ac82950aaa289fd5ec9957800030fcdba0c)
    Reviewed-on: https://gerrit.libreoffice.org/21786
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index 030cf57..8cfc630 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -824,6 +824,8 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, Bitmap* pBmpAlpha, sal_uLon
 
             // read coding information
             rIStm.ReadUInt32( nCodedSize ).ReadUInt32( nUncodedSize ).ReadUInt32( aHeader.nCompression );
+            if (nCodedSize > rIStm.remainingSize())
+               nCodedSize = sal_uInt32(rIStm.remainingSize());
             pData = static_cast<sal_uInt8*>(rtl_allocateMemory( nUncodedSize ));
 
             // decode buffer