[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - vcl/source

[Caolán McNamara]

 vcl/source/filter/ixpm/xpmread.cxx |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

New commits:
commit 3c4e7d1eaf18de200560f13cc0b84673507deb5c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 17 12:35:24 2017 +0000

    ofz#411: XPMReader::ImplGetColKey short read
    
    Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
    Reviewed-on: https://gerrit.libreoffice.org/33218
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/source/filter/ixpm/xpmread.cxx b/vcl/source/filter/ixpm/xpmread.cxx
index bca7f11e0..264139a 100644
--- a/vcl/source/filter/ixpm/xpmread.cxx
+++ b/vcl/source/filter/ixpm/xpmread.cxx
@@ -66,7 +66,7 @@ private:
     sal_uLong               mnWidth;
     sal_uLong               mnHeight;
     sal_uLong               mnColors;
-    sal_uLong               mnCpp;                              // characters per pix
+    sal_uInt32              mnCpp;                              // characters per pix
     bool                mbTransparent;
     bool                mbStatus;
     sal_uLong               mnStatus;
@@ -305,9 +305,12 @@ bool XPMReader::ImplGetColor( sal_uLong nNumb )
     sal_uInt8*  pPtr =  ( mpColMap + nNumb * ( 4 + mnCpp ) );
     bool    bStatus = ImplGetString();
 
-    if ( bStatus )
+    if (bStatus && mnStringSize < mnCpp)
+        bStatus = false;
+
+    if (bStatus)
     {
-        for ( sal_uLong i = 0; i < mnCpp; i++ )
+        for (sal_uInt32 i = 0; i < mnCpp; ++i)
             *pPtr++ = *pString++;
         bStatus = ImplGetColSub ( pPtr );
     }