[Libreoffice-commits] core.git: include/vcl

[Caolán McNamara (via logerrit)]

 include/vcl/RawBitmap.hxx |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit 72da4c623baf60eb2b7073697cd36ffb3022847d
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Aug 29 16:58:11 2021 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sun Aug 29 20:39:00 2021 +0200

    ofz#37796 limit to numeric_limits<int>::max
    
    Change-Id: I6e09226fad1e566ba2758d0084042b603b84d221
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121230
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/include/vcl/RawBitmap.hxx b/include/vcl/RawBitmap.hxx
index b26d532a4032..19fe94cd2c59 100644
--- a/include/vcl/RawBitmap.hxx
+++ b/include/vcl/RawBitmap.hxx
@@ -31,6 +31,10 @@ public:
         , mnBitCount(nBitCount)
     {
         assert(nBitCount == 24 || nBitCount == 32);
+        if (rSize.getWidth() > std::numeric_limits<sal_Int32>::max() || rSize.getWidth() < 0)
+            throw std::bad_alloc();
+        if (rSize.getHeight() > std::numeric_limits<sal_Int32>::max() || rSize.getHeight() < 0)
+            throw std::bad_alloc();
         sal_Int32 nRowSize, nDataSize;
         if (o3tl::checked_multiply<sal_Int32>(rSize.getWidth(), nBitCount / 8, nRowSize)
             || o3tl::checked_multiply<sal_Int32>(nRowSize, rSize.getHeight(), nDataSize)