[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/filter/sgfbram.cxx |    9 +++++++++
 1 file changed, 9 insertions(+)

New commits:
commit e59b69010c9eca5b7c1dd3102141d9a23ab1c5a5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jan 22 21:57:38 2017 +0000

    coverity#1399045 Untrusted value as argument
    
    Change-Id: Icac88c7b439036434cbf2352ac50e954139db4ce

diff --git a/vcl/source/filter/sgfbram.cxx b/vcl/source/filter/sgfbram.cxx
index bfd7012..e25d01f 100644
--- a/vcl/source/filter/sgfbram.cxx
+++ b/vcl/source/filter/sgfbram.cxx
@@ -290,6 +290,14 @@ bool SgfFilterBMap(SvStream& rInp, SvStream& rOut, SgfHeader& rHead, SgfEntry&)
             rOut.WriteBytes(pBuf.get(), nWdtOut);
         }
     } else if (nColors==256) {
+
+        //we're going to loop Ysize * XSize on GetByte, max compression for GetByte is a run of 63
+        //if we're less than that (and add a generous amount of wriggle room) then its not going
+        //to fly
+        const sal_uInt64 nMinBytesPossiblyNeeded = rHead.Xsize * rHead.Ysize / 128;
+        if (rInp.remainingSize() < nMinBytesPossiblyNeeded)
+            return false;
+
         cRGB[3]=0;                      // fourth palette entry for BMP
         for (sal_uInt16 i=0;i<256;i++) {           // copy palette
             rInp.ReadBytes(cRGB, 3);
@@ -325,6 +333,7 @@ bool SgfBMapFilter(SvStream& rInp, SvStream& rOut)
     ReadSgfHeader( rInp, aHead );
     if (!rInp.good())
         return false;
+
     if (aHead.ChkMagic() && (aHead.Typ==SgfBitImag0 || aHead.Typ==SgfBitImag1 ||
                              aHead.Typ==SgfBitImag2 || aHead.Typ==SgfBitImgMo))
     {