filter/qa/cppunit/data/ras/fail/crash-1.ras |binary filter/source/graphicfilter/iras/iras.cxx | 18 +++++++++--------- 2 files changed, 9 insertions(+), 9 deletions(-)
New commits: commit eb70bf3e486102205cf609fa4c879564745eff17 Author: Caolán McNamara <caol...@redhat.com> Date: Wed Jul 15 11:02:13 2015 +0100 file format documentation states these are signed Change-Id: Iaca58dda19d24a767333ff642759414951a03e6d (cherry picked from commit 8a60e78769ebf6fc73ddc8ed7e43991fcb30fff4) Reviewed-on: https://gerrit.libreoffice.org/17063 Reviewed-by: Michael Stahl <mst...@redhat.com> Tested-by: Michael Stahl <mst...@redhat.com> diff --git a/filter/qa/cppunit/data/ras/fail/crash-1.ras b/filter/qa/cppunit/data/ras/fail/crash-1.ras new file mode 100644 index 0000000..d1abbae Binary files /dev/null and b/filter/qa/cppunit/data/ras/fail/crash-1.ras differ diff --git a/filter/source/graphicfilter/iras/iras.cxx b/filter/source/graphicfilter/iras/iras.cxx index cca5bc8..6916daa 100644 --- a/filter/source/graphicfilter/iras/iras.cxx +++ b/filter/source/graphicfilter/iras/iras.cxx @@ -44,12 +44,12 @@ private: bool mbStatus; Bitmap maBmp; - sal_uInt32 mnWidth, mnHeight; // Bildausmass in Pixeln - sal_uInt16 mnDstBitsPerPix; - sal_uInt16 mnDstColors; - sal_uInt32 mnDepth, mnImageDatSize, mnType; - sal_uInt32 mnColorMapType, mnColorMapSize; - sal_uInt8 mnRepCount, mnRepVal; // RLE Decoding + sal_Int32 mnWidth, mnHeight; // Bildausmass in Pixeln + sal_uInt16 mnDstBitsPerPix; + sal_uInt16 mnDstColors; + sal_Int32 mnDepth, mnImageDatSize, mnType; + sal_Int32 mnColorMapType, mnColorMapSize; + sal_uInt8 mnRepCount, mnRepVal; // RLE Decoding bool mbPalette; bool ImplReadBody(BitmapWriteAccess * pAcc); @@ -178,9 +178,9 @@ bool RASReader::ReadRAS(Graphic & rGraphic) bool RASReader::ImplReadHeader() { - m_rRAS.ReadUInt32( mnWidth ).ReadUInt32( mnHeight ).ReadUInt32( mnDepth ).ReadUInt32( mnImageDatSize ). ReadUInt32( mnType ).ReadUInt32( mnColorMapType ).ReadUInt32( mnColorMapSize ); + m_rRAS.ReadInt32(mnWidth).ReadInt32(mnHeight).ReadInt32(mnDepth).ReadInt32(mnImageDatSize).ReadInt32(mnType).ReadInt32(mnColorMapType).ReadInt32(mnColorMapSize); - if ( mnWidth == 0 || mnHeight == 0 ) + if ( mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0 ) mbStatus = false; switch ( mnDepth ) @@ -216,7 +216,7 @@ bool RASReader::ImplReadHeader() bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc) { - sal_uLong x, y; + sal_Int32 x, y; sal_uInt8 nDat = 0; sal_uInt8 nRed, nGreen, nBlue; switch ( mnDstBitsPerPix )
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits