[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipict/ipict.cxx |   26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

New commits:
commit 7055a93318e18853184235753abe247f93a3b085
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Mar 16 13:31:06 2016 +0000

    coverity#1242658 Untrusted loop bound
    
    Change-Id: Iae002c0f925772a56f56162b0e4ac63de2b50d10

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index aff44cd..223efb7 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -834,10 +834,21 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         if ( nRowBytes < nSrcBPL || nRowBytes > nDestBPL )
             BITMAPERROR;
 
-        if ( nRowBytes < 8 || nPackType == 1 ) {
+        if (nRowBytes < 8 || nPackType == 1)
+        {
             if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt8) * nRowBytes))
                 BITMAPERROR;
         }
+        else if (nRowBytes > 250)
+        {
+            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16))
+                BITMAPERROR;
+        }
+        else
+        {
+            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8))
+                BITMAPERROR;
+        }
 
         for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
         {
@@ -907,10 +918,21 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         if (nWidth > nRowBytes / 2)
             BITMAPERROR;
 
-        if ( nRowBytes < 8 || nPackType == 1 ) {
+        if (nRowBytes < 8 || nPackType == 1)
+        {
             if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt16) * nWidth))
                 BITMAPERROR;
         }
+        else if (nRowBytes > 250)
+        {
+            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16))
+                BITMAPERROR;
+        }
+        else
+        {
+            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8))
+                BITMAPERROR;
+        }
 
         for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
         {