[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipict/ipict.cxx |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

New commits:
commit 267d6e19e393f9352ee743d213e8d82f74141877
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jan 30 21:33:39 2017 +0000

    ofz: we're going to need at last a len field and a CounterByte on each row
    
    Change-Id: I5c5c2d67bcba7692e696be6ab96db041b20416a4

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 58d8c79..2fa6228 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -938,14 +938,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt16) * nWidth))
                 return 0xffffffff;
         }
-        else if (nRowBytes > 250)
-        {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16))
-                return 0xffffffff;
-        }
         else
         {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8))
+            size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
+            if (nHeight > pPict->remainingSize() / ((nByteCountSize + sizeof(sal_uInt8)) * nWidth))
                 return 0xffffffff;
         }