[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - vcl/headless

[Caolán McNamara]

 vcl/headless/svpbmp.cxx |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit 8f81f6f743094d05a49f65c0f1ec8d99654780e6
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jun 17 21:16:34 2017 +0100

    ofz#2287 check multiply
    
    Change-Id: Ibc4c93ac1f5686a476b5e303347dc951daa58e33
    Reviewed-on: https://gerrit.libreoffice.org/38910
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>

diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx
index 5be976fc9e74..5ff0b0a978ee 100644
--- a/vcl/headless/svpbmp.cxx
+++ b/vcl/headless/svpbmp.cxx
@@ -135,8 +135,10 @@ BitmapBuffer* ImplCreateDIB(
         pDIB->maPalette.SetEntryCount( nColors );
     }
 
-    const size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
-    if (size > SAL_MAX_INT32/2)
+    size_t size;
+    bFail = o3tl::checked_multiply<size_t>(pDIB->mnHeight, pDIB->mnScanlineSize, size);
+    SAL_WARN_IF(bFail, "vcl.gdi", "checked multiply failed");
+    if (bFail || size > SAL_MAX_INT32/2)
     {
         delete pDIB;
         return nullptr;