[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.1' - desktop/source

[Henry Castro]

 desktop/source/lib/init.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 9985226ec803fa7e714eb10ec4a96a0fe6064e98
Author: Henry Castro <hcastro at collabora.com>
Date:   Tue Nov 29 17:19:00 2016 -0400

    lok: ensure positive values for width and height
    
    also check the pointer memory block allocated
    
    Change-Id: I0ded04e06f80400e64c5e58126a32ee503aeb394
    Reviewed-on: https://gerrit.libreoffice.org/31388
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Henry Castro <hcastro at collabora.com>

diff --git a/desktop/source/lib/init.cxx b/desktop/source/lib/init.cxx
index c36ddd6..3bbf88b 100644
--- a/desktop/source/lib/init.cxx
+++ b/desktop/source/lib/init.cxx
@@ -2580,8 +2580,13 @@ unsigned char* doc_renderFont(LibreOfficeKitDocument* /*pThis*/,
             *pFontWidth = nFontWidth;
             int nFontHeight = aRect.BottomRight().Y() + 1;
             *pFontHeight = nFontHeight;
+            if (!(nFontWidth > 0 && nFontHeight > 0))
+                break;
 
             unsigned char* pBuffer = static_cast<unsigned char*>(malloc(4 * nFontWidth * nFontHeight));
+            if (!pBuffer)
+                break;
+
             memset(pBuffer, 0, nFontWidth * nFontHeight * 4);
             boost::shared_array<sal_uInt8> aBuffer(pBuffer, NoDelete< sal_uInt8 >());