filter/source/graphicfilter/ieps/ieps.cxx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
New commits: commit 28af2749ebe19d8ce2c5972c2b4f70e79ad0356b Author: Caolán McNamara <[email protected]> Date: Fri Jun 2 19:22:19 2017 +0100 ofz: fix remaining length check Change-Id: I1788ae2a15823b0dc165ad1a99bd0f2aac0bcaf1 Reviewed-on: https://gerrit.libreoffice.org/38364 Reviewed-by: Michael Stahl <[email protected]> Reviewed-by: Eike Rathke <[email protected]> Reviewed-by: Markus Mohrhard <[email protected]> Tested-by: Markus Mohrhard <[email protected]> diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx index fecad6b73d75..817a0efada76 100644 --- a/filter/source/graphicfilter/ieps/ieps.cxx +++ b/filter/source/graphicfilter/ieps/ieps.cxx @@ -636,15 +636,17 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* ) if (!bHasPreview && nBytesRead >= nSecurityCount) { sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BeginPreview:"), nBytesRead - nSecurityCount, 15 ); - if ( pDest ) + sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0; + if (nRemainingBytes >= 15) { pDest += 15; + nSecurityCount = nRemainingBytes - 15; long nWidth = ImplGetNumber(pDest, nSecurityCount); long nHeight = ImplGetNumber(pDest, nSecurityCount); long nBitDepth = ImplGetNumber(pDest, nSecurityCount); long nScanLines = ImplGetNumber(pDest, nSecurityCount); - pDest = nSecurityCount ? ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1) : nullptr; // go to the first Scanline - if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines ) + pDest = ImplSearchEntry(pDest, reinterpret_cast<sal_uInt8 const *>("%"), nSecurityCount, 1); // go to the first Scanline + if (pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines) { rStream.Seek( nBufStartPos + ( pDest - pBuf.get() ) );
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
