[Libreoffice-commits] core.git: filter/source

[Libreoffice Gerrit user]

 filter/source/graphicfilter/icgm/bitmap.cxx |    8 ++++++++
 1 file changed, 8 insertions(+)

New commits:
commit 3f726abf5c4c32619f93d4982f8fb1e07619ba40
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jan 30 12:31:55 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Jan 30 15:40:19 2019 +0100

    ofz#12666 fuzzing timeout
    
    Change-Id: I7892bef62c93dd30d5a7d9605e0e6d62fdd35cb1
    Reviewed-on: https://gerrit.libreoffice.org/67133
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/icgm/bitmap.cxx b/filter/source/graphicfilter/icgm/bitmap.cxx
index bca6ec869ff1..375612b19e9b 100644
--- a/filter/source/graphicfilter/icgm/bitmap.cxx
+++ b/filter/source/graphicfilter/icgm/bitmap.cxx
@@ -19,6 +19,8 @@
 
 
 #include "main.hxx"
+#include <sal/log.hxx>
+#include <unotools/configmgr.hxx>
 #include <vcl/BitmapTools.hxx>
 #include <memory>
 
@@ -308,6 +310,12 @@ bool CGMBitmap::ImplGetDimensions( CGMBitmapDescriptor& rDesc )
 
 void CGMBitmap::ImplInsert( CGMBitmapDescriptor const & rSource, CGMBitmapDescriptor& rDest )
 {
+    if (utl::ConfigManager::IsFuzzing() && rDest.mxBitmap.GetSizePixel().Height() + rSource.mnY > SAL_MAX_UINT16)
+    {
+        SAL_WARN("filter.icgm", "bitmap would expand too much");
+        rDest.mbStatus = false;
+        return;
+    }
     rDest.mxBitmap.Expand( 0, rSource.mnY );
     rDest.mxBitmap.CopyPixel( tools::Rectangle( Point( 0, rDest.mnY ), Size( rSource.mnX, rSource.mnY ) ),
         tools::Rectangle( Point( 0, 0 ), Size( rSource.mnX, rSource.mnY ) ), &rSource.mxBitmap );