Kaydet (Commit) 662498ab authored tarafından Stephan Bergmann's avatar Stephan Bergmann

Avoid overflow in PBMReader::ImplReadHeader

...as found by UBSan in CppunitTest_filter_ppm_test on
filter/qa/cppunit/data/pbm/fail/crash-1.pbm

Change-Id: Ib7c50ef1f07aba6b78f79c608be69c3dac38ddfe
üst 63738868
...@@ -218,17 +218,41 @@ bool PBMReader::ImplReadHeader() ...@@ -218,17 +218,41 @@ bool PBMReader::ImplReadHeader()
nDat -= '0'; nDat -= '0';
if ( nCount == 0 ) if ( nCount == 0 )
{ {
if (mnWidth > SAL_MAX_INT32 / 10)
{
return false;
}
mnWidth *= 10; mnWidth *= 10;
if (nDat > SAL_MAX_INT32 - mnWidth)
{
return false;
}
mnWidth += nDat; mnWidth += nDat;
} }
else if ( nCount == 1 ) else if ( nCount == 1 )
{ {
if (mnHeight > SAL_MAX_INT32 / 10)
{
return false;
}
mnHeight *= 10; mnHeight *= 10;
if (nDat > SAL_MAX_INT32 - mnHeight)
{
return false;
}
mnHeight += nDat; mnHeight += nDat;
} }
else if ( nCount == 2 ) else if ( nCount == 2 )
{ {
if (mnMaxVal > std::numeric_limits<sal_uLong>::max() / 10)
{
return false;
}
mnMaxVal *= 10; mnMaxVal *= 10;
if (nDat > std::numeric_limits<sal_uLong>::max() - mnMaxVal)
{
return false;
}
mnMaxVal += nDat; mnMaxVal += nDat;
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment