filter/source/graphicfilter/ipict/ipict.cxx |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

New commits:
commit 4cde204c297ab122b1496444aa2e31c388f621d7
Author: Caolán McNamara <caol...@redhat.com>
Date:   Sun Mar 12 21:16:57 2017 +0000

    ofz: pct oom, avoid allocation bitmap until after size checks are done
    
    Change-Id: I12817adc50d45e2f08b3b5d4cb43daa527d274e9

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx 
b/filter/source/graphicfilter/ipict/ipict.cxx
index 96fc7d8..749bfaf 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -703,8 +703,9 @@ sal_uLong PictReader::ReadAndDrawText()
 
 namespace
 {
-    BitmapWriteAccess* initBitmap(Bitmap &rBitmap, const BitmapPalette 
&rPalette)
+    BitmapWriteAccess* initBitmap(Bitmap &rBitmap, sal_uInt16 nWidth, 
sal_uInt16 nHeight, sal_uInt16 nDstBitCount, const BitmapPalette &rPalette)
     {
+        rBitmap = Bitmap(Size(nWidth, nHeight), nDstBitCount);
         BitmapWriteAccess* pAcc = rBitmap.AcquireWriteAccess();
         if (!pAcc)
             return nullptr;
@@ -757,7 +758,6 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool 
bBaseAddr, bool bColo
             nDstBitCount = 24;
         else if ( nDstBitCount == 2 )
             nDstBitCount = 4;
-        aBitmap = Bitmap( Size( nWidth, nHeight ), nDstBitCount );
 
         if ( bColorTable )
         {
@@ -788,7 +788,6 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool 
bBaseAddr, bool bColo
         nRowBytes &= 0x3fff;
         nPixelSize = nCmpCount = nCmpSize = 1;
         nDataSize += 10;
-        aBitmap = Bitmap(Size(nWidth, nHeight), nDstBitCount);
         aPalette = BitmapPalette(2);
         aPalette[0] = BitmapColor(0xff, 0xff, 0xff);
         aPalette[1] = BitmapColor(0, 0, 0);
@@ -857,7 +856,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool 
bBaseAddr, bool bColo
                 return 0xffffffff;
         }
 
-        if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+        if ( ( pAcc = initBitmap(aBitmap, nWidth, nHeight, nDstBitCount, 
aPalette) ) == nullptr )
             return 0xffffffff;
 
         for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
@@ -940,7 +939,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool 
bBaseAddr, bool bColo
                 return 0xffffffff;
         }
 
-        if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+        if ( ( pAcc = initBitmap(aBitmap, nWidth, nHeight, nDstBitCount, 
aPalette) ) == nullptr )
             return 0xffffffff;
 
         for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
@@ -1037,7 +1036,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, 
bool bBaseAddr, bool bColo
             if (nWidth > nMaxCols)
                 return 0xffffffff;
 
-            if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+            if ( ( pAcc = initBitmap(aBitmap, nWidth, nHeight, nDstBitCount, 
aPalette) ) == nullptr )
                 return 0xffffffff;
 
             for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
@@ -1061,7 +1060,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, 
bool bBaseAddr, bool bColo
             if (nWidth > nMaxCols)
                 return 0xffffffff;
 
-            if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+            if ( ( pAcc = initBitmap(aBitmap, nWidth, nHeight, nDstBitCount, 
aPalette) ) == nullptr )
                 return 0xffffffff;
 
             for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
@@ -1084,7 +1083,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, 
bool bBaseAddr, bool bColo
                 if (nHeight > pPict->remainingSize() / nByteCountSize)
                     return 0xffffffff;
 
-                if ( ( pAcc = initBitmap(aBitmap, aPalette) ) == nullptr )
+                if ( ( pAcc = initBitmap(aBitmap, nWidth, nHeight, 
nDstBitCount, aPalette) ) == nullptr )
                     return 0xffffffff;
 
                 std::unique_ptr<sal_uInt8[]> pScanline(new 
sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

Reply via email to