[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/filter/ixpm/xpmread.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 10a2388558df957b30136ba32ecc97ddef43fb57
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 17 12:35:24 2017 +0000

    ofz#411: XPMReader::ImplGetColKey short read
    
    Change-Id: I2e47ef6478b8349a562b294d0fbdad65c2a3b543
    Reviewed-on: https://gerrit.libreoffice.org/33217
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-on: https://gerrit.libreoffice.org/33216
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/filter/ixpm/xpmread.cxx b/vcl/source/filter/ixpm/xpmread.cxx
index a0306b5..6d348eb 100644
--- a/vcl/source/filter/ixpm/xpmread.cxx
+++ b/vcl/source/filter/ixpm/xpmread.cxx
@@ -65,7 +65,7 @@ private:
     sal_uLong               mnWidth;
     sal_uLong               mnHeight;
     sal_uLong               mnColors;
-    sal_uLong               mnCpp;                              // characters per pix
+    sal_uInt32              mnCpp;                              // characters per pix
     bool                mbTransparent;
     bool                mbStatus;
     sal_uLong               mnStatus;
@@ -268,6 +268,9 @@ bool XPMReader::ImplGetColor()
     if (!ImplGetString())
         return false;
 
+    if (mnStringSize < mnCpp)
+        return false;
+
     OString aKey(reinterpret_cast<sal_Char*>(pString), mnCpp);
     colordata aValue;
     bool bStatus = ImplGetColSub(aValue);