[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara (via logerrit)]

 emfio/source/reader/wmfreader.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit f78090e3d5cc21f8b6c110b39d9f2057d2fa24e9
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Sep 30 09:35:23 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Mon Sep 30 14:33:52 2019 +0200

    ofz#17817 avoid OOM
    
    Change-Id: I354edf5b169e797c76ec79719cdce01e63329df4
    Reviewed-on: https://gerrit.libreoffice.org/79833
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx
index d1e7f85b1c67..58c4d971cb49 100644
--- a/emfio/source/reader/wmfreader.cxx
+++ b/emfio/source/reader/wmfreader.cxx
@@ -711,10 +711,16 @@ namespace emfio
                 bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1 && nBytesPerScan != 0;
                 if (bOk)
                 {
+                    // must be enough data to fulfil the request
                     bOk = nBytesPerScan <= mpInputStream->remainingSize() / nHeight;
                 }
                 if (bOk)
                 {
+                    // scanline must be large enough to provide all pixels
+                    bOk = nBytesPerScan >= nWidth / 8;
+                }
+                if (bOk)
+                {
                     vcl::bitmap::RawBitmap aBmp( Size( nWidth, nHeight ), 24 );
                     for (sal_uInt16 y = 0; y < nHeight && mpInputStream->good(); ++y)
                     {