[Libreoffice-commits] core.git: filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/icgm/bitmap.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit 090cf1e3bbe0ffaf56f22b152b73578483be2f42
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jan 28 16:43:28 2020 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Tue Jan 28 21:36:48 2020 +0100

    ofz#20366 OOM
    
    Change-Id: If658720502739e6ad88c3cf73ac6674e0313a48b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87648
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/icgm/bitmap.cxx b/filter/source/graphicfilter/icgm/bitmap.cxx
index e99349c1684d..3075cf733e48 100644
--- a/filter/source/graphicfilter/icgm/bitmap.cxx
+++ b/filter/source/graphicfilter/icgm/bitmap.cxx
@@ -330,7 +330,15 @@ bool CGMBitmap::ImplGetDimensions( CGMBitmapDescriptor& rDesc )
         rDesc.mbStatus = false;
 
     sal_uInt32 nHeaderSize = 2 + 3 * nPrecision + 3 * mpCGM->ImplGetPointSize();
-    rDesc.mnScanSize = ( ( rDesc.mnX * rDesc.mnDstBitsPerPixel + 7 ) >> 3 );
+
+    sal_uInt32 nWidthBits;
+    if (o3tl::checked_multiply(rDesc.mnX, rDesc.mnDstBitsPerPixel, nWidthBits))
+    {
+        rDesc.mbStatus = false;
+        return false;
+    }
+
+    rDesc.mnScanSize = (nWidthBits + 7) >> 3;
 
     sal_uInt32  nScanSize;
     nScanSize = rDesc.mnScanSize;