[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipict/ipict.cxx |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit 2934b737e9a50febde5a1f681123817bdf8be267
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 1 08:55:58 2017 +0000

    ofz#506 check len before alloc
    
    Change-Id: Ia3a30936fadde10275a964d09150a3b6e4f3e16f

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 9d94996..3fc16ef 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -1080,13 +1080,13 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             sal_uInt8 nFlagCounterByte;
             if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) )
             {
-                if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
-                    return 0xffffffff;
-
                 size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
                 if (nHeight > pPict->remainingSize() / nByteCountSize)
                     return 0xffffffff;
 
+                if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+                    return 0xffffffff;
+
                 std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
                 for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
                 {