filter/source/graphicfilter/ipict/ipict.cxx | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
New commits: commit fbb91632da53d2d0770e8fc3126ffe991fbfecff Author: Caolán McNamara <caol...@redhat.com> Date: Tue Jan 31 10:15:29 2017 +0000 we don't actually need width amount of data in advance to fill the width seeing as we seek from previous position + bytecount on each loop we can only be sure we go forward the min (+1/+2) for each iteration Change-Id: I4f1a29d96c43ee8aa858c97405d196b89994669b diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx index 2fa6228..9d94996 100644 --- a/filter/source/graphicfilter/ipict/ipict.cxx +++ b/filter/source/graphicfilter/ipict/ipict.cxx @@ -851,14 +851,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo if (nHeight > pPict->remainingSize() / (sizeof(sal_uInt8) * nRowBytes)) return 0xffffffff; } - else if (nRowBytes > 250) - { - if (nHeight > pPict->remainingSize() / sizeof(sal_uInt16)) - return 0xffffffff; - } else { - if (nHeight > pPict->remainingSize() / sizeof(sal_uInt8)) + size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8); + if (nHeight > pPict->remainingSize() / nByteCountSize) return 0xffffffff; } @@ -941,7 +937,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo else { size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8); - if (nHeight > pPict->remainingSize() / ((nByteCountSize + sizeof(sal_uInt8)) * nWidth)) + if (nHeight > pPict->remainingSize() / nByteCountSize) return 0xffffffff; } @@ -1087,6 +1083,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr ) return 0xffffffff; + size_t nByteCountSize = nRowBytes > 250 ? sizeof(sal_uInt16) : sizeof(sal_uInt8); + if (nHeight > pPict->remainingSize() / nByteCountSize) + return 0xffffffff; + std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]); for (sal_uInt16 ny = 0; ny < nHeight; ++ny) {
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits