[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ieps/ieps.cxx |    8 +++++++-
 filter/source/graphicfilter/itga/itga.cxx |    2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 13fd5d44c1d528c23bcade92241016195c37c453
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 14 15:06:32 2018 +0000

    ofz#6329 Out-of-memory
    
    Change-Id: I42fef1609db1253bcf262ccf3cc86088ea6ca647
    Reviewed-on: https://gerrit.libreoffice.org/49739
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index a2d94c45faac..e2b5b8e383ab 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -652,7 +652,13 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
                     long nBitDepth = ImplGetNumber(pDest, nSecurityCount);
                     long nScanLines = ImplGetNumber(pDest, nSecurityCount);
                     pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1);       // go to the first Scanline
-                    if (pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines)
+                    bOk = pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines;
+                    if (bOk)
+                    {
+                        long nResult;
+                        bOk = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3;
+                    }
+                    if (bOk)
                     {
                         rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) );
 
diff --git a/filter/source/graphicfilter/itga/itga.cxx b/filter/source/graphicfilter/itga/itga.cxx
index 211537f34e67..28cfb8dd25b8 100644
--- a/filter/source/graphicfilter/itga/itga.cxx
+++ b/filter/source/graphicfilter/itga/itga.cxx
@@ -143,7 +143,7 @@ bool TGAReader::ReadTGA(Graphic & rGraphic)
         {
             sal_Size nSize = mpFileHeader->nImageWidth;
             nSize *= mpFileHeader->nImageHeight;
-            if (nSize > SAL_MAX_INT32/2)
+            if (nSize > SAL_MAX_INT32/2/3)
                 return false;
 
             mpBitmap.reset( new vcl::bitmap::RawBitmap( Size( mpFileHeader->nImageWidth, mpFileHeader->nImageHeight ) ) );