Skip to content

C
core
Kaydet (Commit) 0a272329 authored tarafından Caolán McNamara's avatar Caolán McNamara
Dosyalara gözat
Seçenekler

Related: coverity#1242658 Untrusted loop bound 

Change-Id: I1e7e815c2800b4846498092239b0fadaa5d87b45
üst 00e3da56
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 4 deletions
filter/source/graphicfilter/ipict/ipict.cxx
Dosyayı görüntüle @ 0a272329
......@@ -989,8 +989,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if ( nRowBytes < 8 || nPackType == 1 )
{
const size_t nMaxPixels = pPict->remainingSize() / 4;
const size_t nMaxRows = nMaxPixels / nWidth;
if (nHeight > nMaxRows)
if (static_cast<size_t>(nHeight) * nWidth > nMaxPixels)
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ )
......@@ -1006,8 +1005,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
else if ( nPackType == 2 )
{
const size_t nMaxPixels = pPict->remainingSize() / 3;
const size_t nMaxRows = nMaxPixels / nWidth;
if (nHeight > nMaxRows)
if (static_cast<size_t>(nHeight) * nWidth > nMaxPixels)
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ )
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment