[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ieps/ieps.cxx |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

New commits:
commit e5a25e6b01490cf14dfc6af019fdb0896b19a76d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jun 2 19:22:19 2017 +0100

    ofz: fix remaining length check
    
    Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
    Reviewed-on: https://gerrit.libreoffice.org/38363
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index fecad6b73d75..817a0efada76 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -636,15 +636,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
             if (!bHasPreview && nBytesRead >= nSecurityCount)
             {
                 sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 );
-                if ( pDest  )
+                sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0;
+                if (nRemainingBytes >= 15)
                 {
                     pDest += 15;
+                    nSecurityCount = nRemainingBytes - 15;
                     long nWidth = ImplGetNumber(pDest, nSecurityCount);
                     long nHeight = ImplGetNumber(pDest, nSecurityCount);
                     long nBitDepth = ImplGetNumber(pDest, nSecurityCount);
                     long nScanLines = ImplGetNumber(pDest, nSecurityCount);
-                    pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr;       // go to the first Scanline
-                    if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines )
+                    pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1);       // go to the first Scanline
+                    if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines)
                     {
                         rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) );