vcl/source/filter/png/PngImageReader.cxx | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
New commits:
commit 3bec2d6a8a96102d5a6e93c339601347effa97d7
Author: Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue Mar 19 08:41:13 2024 +0000
Commit: Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Tue Mar 19 22:33:04 2024 +0100
ofz#67495 Out-of-memory
Change-Id: I9c0264b5f474e5448ecaea55e608001438654302
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165016
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
diff --git a/vcl/source/filter/png/PngImageReader.cxx
b/vcl/source/filter/png/PngImageReader.cxx
index 2af433f9d555..0445aff40af9 100644
--- a/vcl/source/filter/png/PngImageReader.cxx
+++ b/vcl/source/filter/png/PngImageReader.cxx
@@ -885,9 +885,11 @@ bool PngImageReader::isAPng(SvStream& rStream)
rStream.ReadUInt32(nChunkType);
if (!rStream.good() || nChunkType != PNG_IHDR_SIGNATURE)
return false;
- rStream.SeekRel(nChunkSize);
+ if (!checkSeek(rStream, rStream.Tell() + nChunkSize))
+ return false;
// Skip IHDR CRC
- rStream.SeekRel(PNG_CRC_SIZE);
+ if (!checkSeek(rStream, rStream.Tell() + PNG_CRC_SIZE))
+ return false;
// Look for acTL chunk that exists before the first IDAT chunk
while (true)
{
