Kaydet (Commit) 7c9c6a44 authored tarafından Caolán McNamara's avatar Caolán McNamara

ofz: move size check before bitmap allocation

Change-Id: I09deab103a3bc53277ea3d545b2737438875dfc5
üst ec7cc3e5
...@@ -90,8 +90,14 @@ bool PCXReader::ReadPCX(Graphic & rGraphic) ...@@ -90,8 +90,14 @@ bool PCXReader::ReadPCX(Graphic & rGraphic)
ImplReadHeader(); ImplReadHeader();
// sanity check there is enough data before trying allocation
if (bStatus && nBytesPerPlaneLin > m_rPCX.remainingSize() / nPlanes)
{
bStatus = false;
}
// Write BMP header and conditionally (maybe invalid for now) color palette: // Write BMP header and conditionally (maybe invalid for now) color palette:
if ( bStatus ) if (bStatus)
{ {
aBmp = Bitmap( Size( nWidth, nHeight ), nDestBitsPerPixel ); aBmp = Bitmap( Size( nWidth, nHeight ), nDestBitsPerPixel );
Bitmap::ScopedWriteAccess pAcc(aBmp); Bitmap::ScopedWriteAccess pAcc(aBmp);
...@@ -108,6 +114,7 @@ bool PCXReader::ReadPCX(Graphic & rGraphic) ...@@ -108,6 +114,7 @@ bool PCXReader::ReadPCX(Graphic & rGraphic)
pAcc->SetPaletteColor( i, BitmapColor ( pPal[ 0 ], pPal[ 1 ], pPal[ 2 ] ) ); pAcc->SetPaletteColor( i, BitmapColor ( pPal[ 0 ], pPal[ 1 ], pPal[ 2 ] ) );
} }
} }
// read bitmap data // read bitmap data
ImplReadBody(pAcc.get()); ImplReadBody(pAcc.get());
...@@ -124,14 +131,8 @@ bool PCXReader::ReadPCX(Graphic & rGraphic) ...@@ -124,14 +131,8 @@ bool PCXReader::ReadPCX(Graphic & rGraphic)
pAcc->SetPaletteColor( i, BitmapColor ( pPal[ 0 ], pPal[ 1 ], pPal[ 2 ] ) ); pAcc->SetPaletteColor( i, BitmapColor ( pPal[ 0 ], pPal[ 1 ], pPal[ 2 ] ) );
} }
} }
/*
// set resolution: if ( bStatus )
if (nResX!=0 && nResY!=0) {
MapMode aMapMode(MapUnit::MapInch,Point(0,0),Fraction(1,nResX),Fraction(1,nResY));
rBitmap.SetPrefMapMode(aMapMode);
rBitmap.SetPrefSize(Size(nWidth,nHeight));
}
*/ if ( bStatus )
{ {
rGraphic = aBmp; rGraphic = aBmp;
return true; return true;
...@@ -206,13 +207,6 @@ void PCXReader::ImplReadBody(BitmapWriteAccess * pAcc) ...@@ -206,13 +207,6 @@ void PCXReader::ImplReadBody(BitmapWriteAccess * pAcc)
sal_uLong nLastPercent = 0; sal_uLong nLastPercent = 0;
sal_uInt8 nDat = 0, nCol = 0; sal_uInt8 nDat = 0, nCol = 0;
//sanity check there is enough data before trying allocation
if (nBytesPerPlaneLin > m_rPCX.remainingSize() / nPlanes)
{
bStatus = false;
return;
}
for( np = 0; np < nPlanes; np++ ) for( np = 0; np < nPlanes; np++ )
pPlane[ np ] = new sal_uInt8[ nBytesPerPlaneLin ]; pPlane[ np ] = new sal_uInt8[ nBytesPerPlaneLin ];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment