Kaydet (Commit) 875044ac authored tarafından Julien Nabet's avatar Julien Nabet Kaydeden (comit) Caolán McNamara

CID#736170, CID#736171, CID#736172 Out-of-Bounds read/write

Let's be sure that nMaxcolorIndex < 256

Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467
Reviewed-on: https://gerrit.libreoffice.org/6970Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst 25a2fb21
......@@ -316,17 +316,16 @@ void CGM::ImplDoClass5()
if ( nMaxColorIndex > 255 )
{
mbStatus = sal_False;
break;
}
else
{
if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
pElement->nLatestColorMaximumIndex = nMaxColorIndex;
if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
pElement->nLatestColorMaximumIndex = nMaxColorIndex;
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{
pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
}
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{
pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
}
pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex;
for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment