[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipbm/ipbm.cxx |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

New commits:
commit b8bb1c259d2c2f493b5cb05dbe234472c0e41ddc
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 14 14:18:53 2018 +0000

    ofz#6323 Abrt
    
    Change-Id: Ia87b2430508648e6a77d291d4d86924bfc848ecc
    Reviewed-on: https://gerrit.libreoffice.org/49729
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx
index 686f32119a97..06f51d0e9bac 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -79,16 +79,17 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     if ( ( mnMaxVal == 0 ) || ( mnWidth <= 0 ) || ( mnHeight <= 0 ) )
         return false;
 
+    sal_uInt32 nPixelsRequired;
+    if (o3tl::checked_multiply<sal_uInt32>(mnWidth, mnHeight, nPixelsRequired))
+        return false;
+    const auto nRemainingSize = mrPBM.remainingSize();
+
     // 0->PBM, 1->PGM, 2->PPM
     switch ( mnMode )
     {
         case 0:
         {
-            sal_uInt32 nDataRequired;
-            if (o3tl::checked_multiply<sal_uInt32>(mnWidth, mnHeight, nDataRequired))
-                return false;
-            const auto nRemainingSize = mrPBM.remainingSize();
-            if (nRemainingSize < nDataRequired / 8)
+            if (nRemainingSize < nPixelsRequired / 8)
                 return false;
 
             mpRawBmp.reset( new vcl::bitmap::RawBitmap( Size( mnWidth, mnHeight ) ) );
@@ -98,6 +99,9 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
             break;
         }
         case 1 :
+            if (nRemainingSize < nPixelsRequired)
+                return false;
+
             mpRawBmp.reset( new vcl::bitmap::RawBitmap( Size( mnWidth, mnHeight ) ) );
             mnCol = static_cast<sal_uInt16>(mnMaxVal) + 1;
             if ( mnCol > 256 )
@@ -111,6 +115,9 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
             }
             break;
         case 2 :
+            if (nRemainingSize / 3 < nPixelsRequired)
+                return false;
+
             mpRawBmp.reset( new vcl::bitmap::RawBitmap( Size( mnWidth, mnHeight ) ) );
             break;
     }