[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/iras/iras.cxx |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

New commits:
commit ef4f097d3e76b172d2556d52ffbf3f9468780d1f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 14 10:33:24 2017 +0000

    check ras seeks
    
    Change-Id: Id4c55ad57c49f08eff813a3ad5325d7788688c51

diff --git a/filter/source/graphicfilter/iras/iras.cxx b/filter/source/graphicfilter/iras/iras.cxx
index 21e554f..3fb27e5 100644
--- a/filter/source/graphicfilter/iras/iras.cxx
+++ b/filter/source/graphicfilter/iras/iras.cxx
@@ -78,6 +78,15 @@ RASReader::RASReader(SvStream &rRAS)
 {
 }
 
+namespace
+{
+    bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
+    {
+        const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+        return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
+    }
+}
+
 bool RASReader::ReadRAS(Graphic & rGraphic)
 {
     sal_uInt32 nMagicNumber;
@@ -99,12 +108,13 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
     bool bPalette(false);
     BitmapPalette aPalette;
 
+    bool bOk = true;
     if ( mnDstBitsPerPix <= 8 )     // paletten bildchen
     {
         if ( mnColorMapType == RAS_COLOR_RAW_MAP )      // RAW Colormap wird geskipped
         {
             sal_uLong nCurPos = m_rRAS.Tell();
-            m_rRAS.Seek( nCurPos + mnColorMapSize );
+            bOk = checkSeek(m_rRAS, nCurPos + mnColorMapSize);
         }
         else if ( mnColorMapType == RAS_COLOR_RGB_MAP ) // RGB koennen wir auslesen
         {
@@ -151,10 +161,13 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
         if ( mnColorMapType != RAS_COLOR_NO_MAP )   // when graphic has more than 256 colors and a color map we skip
         {                                           // the colormap
             sal_uLong nCurPos = m_rRAS.Tell();
-            m_rRAS.Seek( nCurPos + mnColorMapSize );
+            bOk = checkSeek(m_rRAS, nCurPos + mnColorMapSize);
         }
     }
 
+    if (!bOk)
+        return false;
+
     Bitmap aBmp(Size(mnWidth, mnHeight), mnDstBitsPerPix);
     Bitmap::ScopedWriteAccess pAcc(aBmp);
     if (pAcc == nullptr)