[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ipcx/ipcx.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 369018cffb6d1c77e2fb4feec6a4df8a27872ec5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 14 15:11:06 2018 +0000

    ofz#6330 Out-of-memory
    
    Change-Id: Ie138705e7994915d7824d8cf1ae1a0e17e247256
    Reviewed-on: https://gerrit.libreoffice.org/49740
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ipcx/ipcx.cxx b/filter/source/graphicfilter/ipcx/ipcx.cxx
index c06a5159ec5e..51b50be2fa56 100644
--- a/filter/source/graphicfilter/ipcx/ipcx.cxx
+++ b/filter/source/graphicfilter/ipcx/ipcx.cxx
@@ -40,7 +40,7 @@ private:
     sal_uLong           nPlanes;            // no of planes
     sal_uLong           nBytesPerPlaneLin;  // bytes per plane line
 
-    sal_uLong           nWidth, nHeight;    // dimension in pixel
+    sal_uInt32          nWidth, nHeight;    // dimension in pixel
     sal_uInt16          nResX, nResY;       // resolution in pixel per inch or 0,0
     sal_uInt16          nDestBitsPerPixel;  // bits per pixel in destination bitmap 1,4,8 or 24
     std::unique_ptr<sal_uInt8[]>
@@ -96,6 +96,12 @@ bool PCXReader::ReadPCX(Graphic & rGraphic)
         bStatus = false;
     }
 
+    if (bStatus)
+    {
+        sal_uInt32 nResult;
+        bStatus = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3;
+    }
+
     // Write BMP header and conditionally (maybe invalid for now) color palette:
     if (bStatus)
     {