[Libreoffice-commits] core.git: include/vcl

[Caolán McNamara]

 include/vcl/BitmapTools.hxx |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

New commits:
commit 40bc6c1380226677ef72b9667dba9d577087dfc6
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Apr 4 17:05:46 2018 +0100

    ofz#7365 Integer overflow
    
    Change-Id: If56db771976a82399dc49fd90845e6569cbd2e8e
    Reviewed-on: https://gerrit.libreoffice.org/52400
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/include/vcl/BitmapTools.hxx b/include/vcl/BitmapTools.hxx
index 75c68e9ab67a..00f7d1b89b5e 100644
--- a/include/vcl/BitmapTools.hxx
+++ b/include/vcl/BitmapTools.hxx
@@ -22,6 +22,7 @@
 #include <com/sun/star/geometry/IntegerRectangle2D.hpp>
 #include <basegfx/range/b2drectangle.hxx>
 #include <basegfx/matrix/b2dhommatrix.hxx>
+#include <o3tl/safeint.hxx>
 
 namespace vcl {
 namespace bitmap {
@@ -37,11 +38,17 @@ friend BitmapEx VCL_DLLPUBLIC CreateFromData( RawBitmap&& rawBitmap );
     sal_uInt8 mnBitCount;
 public:
     RawBitmap(Size const & rSize, sal_uInt8 nBitCount)
-        : mpData(new sal_uInt8[ rSize.getWidth() * nBitCount/8 * rSize.getHeight()]),
-          maSize(rSize),
+        : maSize(rSize),
           mnBitCount(nBitCount)
     {
         assert(nBitCount == 24 || nBitCount == 32);
+        sal_Int32 nRowSize, nDataSize;
+        if (o3tl::checked_multiply<sal_Int32>(rSize.getWidth(), nBitCount/8, nRowSize) ||
+            o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize))
+        {
+            throw std::bad_alloc();
+        }
+        mpData.reset(new sal_uInt8[nDataSize]);
     }
     void SetPixel(long nY, long nX, Color nColor)
     {