emfio/source/reader/wmfreader.cxx | 6 ++++++ 1 file changed, 6 insertions(+)
New commits: commit f78090e3d5cc21f8b6c110b39d9f2057d2fa24e9 Author: Caolán McNamara <caol...@redhat.com> AuthorDate: Mon Sep 30 09:35:23 2019 +0100 Commit: Caolán McNamara <caol...@redhat.com> CommitDate: Mon Sep 30 14:33:52 2019 +0200 ofz#17817 avoid OOM Change-Id: I354edf5b169e797c76ec79719cdce01e63329df4 Reviewed-on: https://gerrit.libreoffice.org/79833 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index d1e7f85b1c67..58c4d971cb49 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -711,10 +711,16 @@ namespace emfio bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1 && nBytesPerScan != 0; if (bOk) { + // must be enough data to fulfil the request bOk = nBytesPerScan <= mpInputStream->remainingSize() / nHeight; } if (bOk) { + // scanline must be large enough to provide all pixels + bOk = nBytesPerScan >= nWidth / 8; + } + if (bOk) + { vcl::bitmap::RawBitmap aBmp( Size( nWidth, nHeight ), 24 ); for (sal_uInt16 y = 0; y < nHeight && mpInputStream->good(); ++y) { _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits