[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipict/ipict.cxx |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

New commits:
commit fbb91632da53d2d0770e8fc3126ffe991fbfecff
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 31 10:15:29 2017 +0000

    we don't actually need width amount of data in advance to fill the width
    
    seeing as we seek from previous position + bytecount on each loop
    we can only be sure we go forward the min (+1/+2) for each iteration
    
    Change-Id: I4f1a29d96c43ee8aa858c97405d196b89994669b

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 2fa6228..9d94996 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -851,14 +851,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt8) * nRowBytes))
                 return 0xffffffff;
         }
-        else if (nRowBytes > 250)
-        {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16))
-                return 0xffffffff;
-        }
         else
         {
-            if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8))
+            size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
+            if (nHeight > pPict->remainingSize() / nByteCountSize)
                 return 0xffffffff;
         }
 
@@ -941,7 +937,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         else
         {
             size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
-            if (nHeight > pPict->remainingSize() / ((nByteCountSize + sizeof(sal_uInt8)) * nWidth))
+            if (nHeight > pPict->remainingSize() / nByteCountSize)
                 return 0xffffffff;
         }
 
@@ -1087,6 +1083,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
                 if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
                     return 0xffffffff;
 
+                size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8);
+                if (nHeight > pPict->remainingSize() / nByteCountSize)
+                    return 0xffffffff;
+
                 std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
                 for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
                 {