[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/pbm/fail/crash-1.pbm |    6 ++++++
 filter/source/graphicfilter/ipbm/ipbm.cxx   |   11 ++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

New commits:
commit 25418bf4997e3f1b31e0da87ee0947ad9c8da2ce
Author: Caolán McNamara <caol...@redhat.com>
Date:   Mon Aug 24 20:43:37 2015 +0100

    in reality we are limited to max sal_Int32 here
    
    so accept that and test if the values were accepted or limited
    
    Change-Id: Iaed5ebc2f12b52055506147c71117a2ad88d28ac
    (cherry picked from commit 0a76c1fd6875bd094ebe2bfbed3d01c98dc0c19e)
    Reviewed-on: https://gerrit.libreoffice.org/17972
    Reviewed-by: David Tardon <dtar...@redhat.com>
    Tested-by: David Tardon <dtar...@redhat.com>

diff --git a/filter/qa/cppunit/data/pbm/fail/crash-1.pbm 
b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
new file mode 100644
index 0000000..9ddcddf
--- /dev/null
+++ b/filter/qa/cppunit/data/pbm/fail/crash-1.pbm
@@ -0,0 +1,6 @@
+P3
+30000000000000000000000000000000 1
+255
+103  79  59
+ 95  7P  55
+ 87  67  51
diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx 
b/filter/source/graphicfilter/ipbm/ipbm.cxx
index e545334..18b3249 100644
--- a/filter/source/graphicfilter/ipbm/ipbm.cxx
+++ b/filter/source/graphicfilter/ipbm/ipbm.cxx
@@ -37,7 +37,7 @@ private:
     sal_uLong           mnMode;             // 0->PBM, 1->PGM, 2->PPM
     Bitmap              maBmp;
     BitmapWriteAccess*  mpAcc;
-    sal_uLong           mnWidth, mnHeight;  // dimensions in pixel
+    sal_Int32       mnWidth, mnHeight;  // dimensions in pixel
     sal_uLong           mnCol;
     sal_uLong           mnMaxVal;           // max value in the <missing 
comment>
     bool            ImplReadBody();
@@ -83,7 +83,7 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     if ( !( mbStatus = ImplReadHeader() ) )
         return false;
 
-    if ( ( mnMaxVal == 0 ) || ( mnWidth == 0 ) || ( mnHeight == 0 ) )
+    if ( ( mnMaxVal == 0 ) || ( mnWidth <= 0 ) || ( mnHeight <= 0 ) )
         return false;
 
     // 0->PBM, 1->PGM, 2->PPM
@@ -91,7 +91,8 @@ bool PBMReader::ReadPBM(Graphic & rGraphic )
     {
         case 0 :
             maBmp = Bitmap( Size( mnWidth, mnHeight ), 1 );
-            if ( ( mpAcc = maBmp.AcquireWriteAccess() ) == 0 )
+            mpAcc = maBmp.AcquireWriteAccess();
+            if (!mpAcc || mpAcc->Width() != mnWidth || mpAcc->Height() != 
mnHeight)
                 return false;
             mpAcc->SetPaletteEntryCount( 2 );
             mpAcc->SetPaletteColor( 0, BitmapColor( 0xff, 0xff, 0xff ) );
@@ -242,8 +243,8 @@ bool PBMReader::ImplReadBody()
     bool    bPara, bFinished = false;
     sal_uInt8   nDat = 0, nCount;
     sal_uLong   nGrey, nRGB[3];
-    sal_uLong   nWidth = 0;
-    sal_uLong   nHeight = 0;
+    sal_Int32 nWidth = 0;
+    sal_Int32 nHeight = 0;
 
     if ( mbRaw )
     {

_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits