filter/source/graphicfilter/ipbm/ipbm.cxx | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
New commits: commit 0382dd6b26a77484cc2818ea1655da373fa92e5f Author: Stephan Bergmann <sberg...@redhat.com> Date: Tue Aug 25 11:58:42 2015 +0200 Avoid overflow in PBMReader::ImplReadHeader ...as found by UBSan in CppunitTest_filter_ppm_test on filter/qa/cppunit/data/pbm/fail/crash-1.pbm Change-Id: Ib7c50ef1f07aba6b78f79c608be69c3dac38ddfe (cherry picked from commit 662498ab80833a2b671c247fb859603632e52105) Reviewed-on: https://gerrit.libreoffice.org/17989 Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/filter/source/graphicfilter/ipbm/ipbm.cxx b/filter/source/graphicfilter/ipbm/ipbm.cxx index 231b0e6..89ac09d 100644 --- a/filter/source/graphicfilter/ipbm/ipbm.cxx +++ b/filter/source/graphicfilter/ipbm/ipbm.cxx @@ -234,17 +234,41 @@ bool PBMReader::ImplReadHeader() nDat -= '0'; if ( nCount == 0 ) { + if (mnWidth > SAL_MAX_INT32 / 10) + { + return false; + } mnWidth *= 10; + if (nDat > SAL_MAX_INT32 - mnWidth) + { + return false; + } mnWidth += nDat; } else if ( nCount == 1 ) { + if (mnHeight > SAL_MAX_INT32 / 10) + { + return false; + } mnHeight *= 10; + if (nDat > SAL_MAX_INT32 - mnHeight) + { + return false; + } mnHeight += nDat; } else if ( nCount == 2 ) { + if (mnMaxVal > std::numeric_limits<sal_uLong>::max() / 10) + { + return false; + } mnMaxVal *= 10; + if (nDat > std::numeric_limits<sal_uLong>::max() - mnMaxVal) + { + return false; + } mnMaxVal += nDat; } }
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits