[Libreoffice-commits] core.git: filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/ipict/ipict.cxx |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

New commits:
commit cf0f5d056efe28eb6177fbcfb80efe3337e5c5f2
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Oct 20 15:40:45 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sun Oct 20 17:25:24 2019 +0200

    cid#1441466 silence Untrusted loop bound
    
    Change-Id: I692f591cb3bee63ec0a0a77b3d9a4a54973451ad
    Reviewed-on: https://gerrit.libreoffice.org/81169
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 560841037b98..e2d0e9cacd3d 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -1094,14 +1094,14 @@ sal_uLong PictReader::ReadPixMapEtc( BitmapEx &rBitmap, bool bBaseAddr, bool bCo
                         nByteCount++;
                     }
                     size_t i = 0;
-                    while (i < nByteWidth)
+                    while (i < aScanline.size())
                     {
                         pPict->ReadUChar( nFlagCounterByte );
                         if ( ( nFlagCounterByte & 0x80 ) == 0)
                         {
                             nCount = static_cast<sal_uInt16>(nFlagCounterByte) + 1;
-                            if ((i + nCount) > nByteWidth)
-                                nCount = nByteWidth - i;
+                            if ((i + nCount) > aScanline.size())
+                                nCount = aScanline.size() - i;
                             if (pPict->remainingSize() < nCount)
                                 return 0xffffffff;
                             while( nCount-- )
@@ -1115,8 +1115,8 @@ sal_uLong PictReader::ReadPixMapEtc( BitmapEx &rBitmap, bool bBaseAddr, bool bCo
                             if (pPict->remainingSize() < 1)
                                 return 0xffffffff;
                             nCount = ( 1 - sal_Int16( static_cast<sal_uInt16>(nFlagCounterByte) | 0xff00 ) );
-                            if (( i + nCount) > nByteWidth)
-                                nCount = nByteWidth - i;
+                            if (( i + nCount) > aScanline.size())
+                                nCount = aScanline.size() - i;
                             pPict->ReadUChar( nDat );
                             while( nCount-- )
                                 aScanline[ i++ ] = nDat;