at least partially sanitize image dimensions

... to avoid enormous allocations later. Change-Id: I8ffb050f095bd7ba2fee5be738bb30cd45170b82
2016-01-21 12:30:21 +01:00
parent 8608b276ae
commit 32b0e02e5b
1 changed files with 11 additions and 0 deletions
@@ -301,6 +301,17 @@ bool ImplReadDIBInfoHeader(SvStream& rIStm, DIBV5Header& rHeader, bool& bTopDown
        return false;
    }

+    if (rHeader.nCompression == 0)
+    {
+        sal_uInt64 nMaxSize = rIStm.remainingSize();
+        if (rHeader.nHeight != 0)
+            nMaxSize /= rHeader.nHeight;
+        if (rHeader.nPlanes != 0)
+            nMaxSize /= rHeader.nPlanes;
+        if (sal_Int64(nMaxSize) < rHeader.nWidth)
+            return false;
+    }
+
    return rIStm.good();
 }