[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - vcl/headless

[Caolán McNamara]

 vcl/headless/svpbmp.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit 67caad3c98d045b8de3e4bf2f63efda2e9d8cc48
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jun 17 21:16:34 2017 +0100

    ofz#2287 check multiply
    
    Change-Id: Ibc4c93ac1f5686a476b5e303347dc951daa58e33
    Reviewed-on: https://gerrit.libreoffice.org/38911
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>

diff --git a/vcl/headless/svpbmp.cxx b/vcl/headless/svpbmp.cxx
index 71c5e52586c6..02aa41b66bc5 100644
--- a/vcl/headless/svpbmp.cxx
+++ b/vcl/headless/svpbmp.cxx
@@ -135,7 +135,15 @@ BitmapBuffer* ImplCreateDIB(
 
             try
             {
-                size_t size = pDIB->mnScanlineSize * pDIB->mnHeight;
+                size_t size;
+                bFail = o3tl::checked_multiply<size_t>(pDIB->mnHeight, pDIB->mnScanlineSize, size);
+                SAL_WARN_IF(bFail, "vcl.gdi", "checked multiply failed");
+                if (bFail)
+                {
+                    delete pDIB;
+                    return nullptr;
+                }
+
                 pDIB->mpBits = new sal_uInt8[size];
 #ifdef __SANITIZE_ADDRESS__
                 if (!pDIB->mpBits)