Kaydet (Commit) 875044ac authored tarafından Julien Nabet's avatar Julien Nabet Kaydeden (comit) Caolán McNamara

CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write

Let's be sure that nMaxcolorIndex < 256

Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467
Reviewed-on: https://gerrit.libreoffice.org/6970Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst 25a2fb21
...@@ -316,17 +316,16 @@ void CGM::ImplDoClass5() ...@@ -316,17 +316,16 @@ void CGM::ImplDoClass5()
if ( nMaxColorIndex > 255 ) if ( nMaxColorIndex > 255 )
{ {
mbStatus = sal_False; mbStatus = sal_False;
break;
} }
else if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
{ pElement->nLatestColorMaximumIndex = nMaxColorIndex;
if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
pElement->nLatestColorMaximumIndex = nMaxColorIndex;
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{ {
pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True ); pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
}
} }
pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex; pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex;
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ ) for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment