Related: #i120306# better input checks in WinSalBitmap::ImplCreateDIB()

Patch-by: hdu, orw
(cherry picked from commit 7b699076)

Conflicts:
	vcl/win/source/gdi/salbmp.cxx

Change-Id: I106efb3960cb99367d2ecefb8bcae006f389e271

Corrected static_cast which does not work on Win compiler

reinterpret cas needed (base classes are not related)

(cherry picked from commit 99e4d3a5)

Change-Id: I02fc89d1ab346231985c68d63d9710c036d2ab2a

vcl/win/source/gdi/salbmp.cxx

@@ -329,17 +329,29 @@ HGLOBAL WinSalBitmap::ImplCreateDIB( const Size& rSize, sal_uInt16 nBits, const
 
     HGLOBAL hDIB = 0;
 
-    if ( rSize.Width() && rSize.Height() )
-    {
-        const sal_uLong     nImageSize = AlignedWidth4Bytes( nBits * rSize.Width() ) * rSize.Height();
-        const sal_uInt16    nColors = ( nBits <= 8 ) ? ( 1 << nBits ) : 0;
+    if( rSize.Width() <= 0 || rSize.Height() <= 0 )
+        return hDIB;
 
-        hDIB = GlobalAlloc( GHND, sizeof( BITMAPINFOHEADER ) + nColors * sizeof( RGBQUAD ) + nImageSize );
+    // calculate bitmap size in Bytes
+    const sal_uLong nAlignedWidth4Bytes = AlignedWidth4Bytes( nBits * rSize.Width() );
+    const sal_uLong nImageSize = nAlignedWidth4Bytes * rSize.Height();
+    bool bOverflow = (nImageSize / nAlignedWidth4Bytes) != rSize.Height();
+    if( bOverflow )
+        return hDIB;
 
-        if( hDIB )
-        {
-            PBITMAPINFO         pBI = (PBITMAPINFO) GlobalLock( hDIB );
-            PBITMAPINFOHEADER   pBIH = (PBITMAPINFOHEADER) pBI;
+    // allocate bitmap memory including header and palette
+    const sal_uInt16 nColors = (nBits <= 8) ? (1 << nBits) : 0;
+    const sal_uLong nHeaderSize = sizeof( BITMAPINFOHEADER ) + nColors * sizeof( RGBQUAD );
+    bOverflow = (nHeaderSize + nImageSize) < nImageSize;
+    if( bOverflow )
+        return hDIB;
+
+    hDIB = GlobalAlloc( GHND, nHeaderSize + nImageSize );
+    if( !hDIB )
+        return hDIB;
+
+    PBITMAPINFO pBI = static_cast<PBITMAPINFO>( GlobalLock( hDIB ) );
+    PBITMAPINFOHEADER pBIH = reinterpret_cast<PBITMAPINFOHEADER>( pBI );
 
     pBIH->biSize = sizeof( BITMAPINFOHEADER );
     pBIH->biWidth = rSize.Width();
@@ -353,17 +365,15 @@ HGLOBAL WinSalBitmap::ImplCreateDIB( const Size& rSize, sal_uInt16 nBits, const
     pBIH->biClrUsed = 0;
     pBIH->biClrImportant = 0;
 
-            if ( nColors )
+    if( nColors )
     {
+        // copy the palette entries if any
         const sal_uInt16 nMinCount = std::min( nColors, rPal.GetEntryCount() );
-
         if( nMinCount )
-                    memcpy( pBI->bmiColors, rPal.ImplGetColorBuffer(), nMinCount * sizeof( RGBQUAD ) );
+            memcpy( pBI->bmiColors, rPal.ImplGetColorBuffer(), nMinCount * sizeof(RGBQUAD) );
     }
 
     GlobalUnlock( hDIB );
-        }
-    }
 
     return hDIB;
 }