coverity#1242658 Untrusted loop bound

Change-Id: I6b4605e3223d11fe4f905e0d9141043a0d7527da

coverity#1242658 Untrusted loop bound
Change-Id: I6b4605e3223d11fe4f905e0d9141043a0d7527da
b723d52a · Caolán McNamara · 9263fbe3 · b723d52a
Kaydet (Commit) b723d52a authored Eki 30, 2014 tarafından Caolán McNamara
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 0 deletions

ipict.cxx filter/source/graphicfilter/ipict/ipict.cxx +5 -0

No files found.
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -988,6 +988,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo

        if ( nRowBytes < 8 || nPackType == 1 )
        {
+            const size_t nMaxPixels = pPict->remainingSize() / 4;
+            const size_t nMaxRows = nMaxPixels / nWidth;
+            if (nHeight > nMaxRows)
+                BITMAPERROR;
+
            for ( ny = 0; ny < nHeight; ny++ )
            {
                for ( nx = 0; nx < nWidth; nx++ )