ofz#6329 Out-of-memory

Change-Id: I42fef1609db1253bcf262ccf3cc86088ea6ca647
Reviewed-on: https://gerrit.libreoffice.org/49739Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

filter/source/graphicfilter/ieps/ieps.cxx

@@ -652,7 +652,13 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
                     long nBitDepth = ImplGetNumber(pDest, nSecurityCount);
                     long nScanLines = ImplGetNumber(pDest, nSecurityCount);
                     pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1);       // go to the first Scanline
-                    if (pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines)
+                    bOk = pDest && nWidth > 0 && nHeight > 0 && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines;
+                    if (bOk)
+                    {
+                        long nResult;
+                        bOk = !o3tl::checked_multiply(nWidth, nHeight, nResult) && nResult <= SAL_MAX_INT32/2/3;
+                    }
+                    if (bOk)
                     {
                         rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) );
 

filter/source/graphicfilter/itga/itga.cxx

@@ -143,7 +143,7 @@ bool TGAReader::ReadTGA(Graphic & rGraphic)
         {
             sal_Size nSize = mpFileHeader->nImageWidth;
             nSize *= mpFileHeader->nImageHeight;
-            if (nSize > SAL_MAX_INT32/2)
+            if (nSize > SAL_MAX_INT32/2/3)
                 return false;
 
             mpBitmap.reset( new vcl::bitmap::RawBitmap( Size( mpFileHeader->nImageWidth, mpFileHeader->nImageHeight ) ) );