[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipbm/ipbm.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit c137652c30667ffe1dde40c22ee9584190f26dc9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 13 13:38:07 2018 +0000

    ofz#6291 Out-of-memory
    
    Change-Id: Ib68f1a2804a75a482cc72c68b2de4d266c8cbeb4
    Reviewed-on: https://gerrit.libreoffice.org/49653
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx
index 1de647434f7e..686f32119a97 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -18,7 +18,7 @@
  */
 
 #include <sal/config.h>
-
+#include <o3tl/safeint.hxx>
 #include <vcl/FilterConfigItem.hxx>
 #include <vcl/graph.hxx>
 #include <vcl/BitmapTools.hxx>
@@ -84,9 +84,11 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     {
         case 0:
         {
-            const size_t nRemainingSize = mrPBM.remainingSize();
-            const size_t nDataRequired = static_cast<size_t>(mnWidth) * (mnHeight / 8);
-            if (nRemainingSize < nDataRequired)
+            sal_uInt32 nDataRequired;
+            if (o3tl::checked_multiply<sal_uInt32>(mnWidth, mnHeight, nDataRequired))
+                return false;
+            const auto nRemainingSize = mrPBM.remainingSize();
+            if (nRemainingSize < nDataRequired / 8)
                 return false;
 
             mpRawBmp.reset( new vcl::bitmap::RawBitmap( Size( mnWidth, mnHeight ) ) );