lotuswordpro/source/filter/lwpdrawobj.cxx |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

New commits:
commit dfcf8a75a975b09d3a39e4c753a717dc67036a3c
Author:     zhutyra <zhutyra>
AuthorDate: Tue Feb 1 13:54:55 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Feb 1 20:37:30 2022 +0100

    read of width/height uses wrong record size
    
    this initially went wrong at:
    
    commit b4fb7a437bb0ce987702b12008737756623618ac
    Date:   Mon May 23 21:38:40 2011 +0100
    
        fix up some more endian
    
    LIBREOFFICE-SBQ5TJRS
    
    Change-Id: Ie418f530f55288351f73f3c0cbab9ac48e6b6964
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129293
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx 
b/lotuswordpro/source/filter/lwpdrawobj.cxx
index ad14a778d2cb..7e1322a8f67f 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -1383,8 +1383,12 @@ void LwpDrawBitmap::Read()
 
     if (aInfoHeader2.nHeaderLen == sizeof(BmpInfoHeader))
     {
-        m_pStream->ReadUInt32( aInfoHeader2.nWidth );
-        m_pStream->ReadUInt32( aInfoHeader2.nHeight );
+        sal_uInt16 nTmp;
+
+        m_pStream->ReadUInt16( nTmp );
+        aInfoHeader2.nWidth = nTmp;
+        m_pStream->ReadUInt16( nTmp );
+        aInfoHeader2.nHeight = nTmp;
         m_pStream->ReadUInt16( aInfoHeader2.nPlanes );
         m_pStream->ReadUInt16( aInfoHeader2.nBitCount );
 

Reply via email to