coverity#1242704 Untrusted loop bound

Change-Id: Id8a80028ad00ec7ae79eaa9d877a1fef9f4d082c

coverity#1242704 Untrusted loop bound
Change-Id: Id8a80028ad00ec7ae79eaa9d877a1fef9f4d082c
f1a9c527 · Caolán McNamara · 7be2fba4 · f1a9c527
Kaydet (Commit) f1a9c527 authored Eyl 29, 2015 tarafından Caolán McNamara
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 1 deletion

winwmf.cxx vcl/source/filter/wmf/winwmf.cxx +6 -1

No files found.
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -643,7 +643,12 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
            Point aPoint( ReadYX() );
            pWMF->ReadUInt16( nDontKnow ).ReadUInt16( nWidth ).ReadUInt16( nHeight ).ReadUInt16( nBytesPerScan ).ReadUChar( nPlanes ).ReadUChar( nBitCount );

-            if ( nWidth && nHeight && ( nPlanes == 1 ) && ( nBitCount == 1 ) )
+            bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1;
+            if (bOk)
+            {
+                bOk = nBytesPerScan <= pWMF->remainingSize() / nHeight;
+            }
+            if (bOk)
            {
                Bitmap aBmp( Size( nWidth, nHeight ), nBitCount );
                BitmapWriteAccess* pAcc;