[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ieps/ieps.cxx |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

New commits:
commit 9863be5254fcce6b74da30b821e9263002e9ac71
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jun 2 19:22:19 2017 +0100

    ofz#2085: fix remaining length check
    
    Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1
    Reviewed-on: https://gerrit.libreoffice.org/38361
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index 34e68abfc0d8..81841d8b0891 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -647,15 +647,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
             if (!bHasPreview && nBytesRead >= nSecurityCount)
             {
                 sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 );
-                if ( pDest  )
+                sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0;
+                if (nRemainingBytes >= 15)
                 {
                     pDest += 15;
+                    nSecurityCount = nRemainingBytes - 15;
                     long nWidth = ImplGetNumber(pDest, nSecurityCount);
                     long nHeight = ImplGetNumber(pDest, nSecurityCount);
                     long nBitDepth = ImplGetNumber(pDest, nSecurityCount);
                     long nScanLines = ImplGetNumber(pDest, nSecurityCount);
-                    pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr;       // go to the first Scanline
-                    if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines )
+                    pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1);       // go to the first Scanline
+                    if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines)
                     {
                         rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) );