-
Notifications
You must be signed in to change notification settings - Fork 2
/
workspace.impress208.patch
112 lines (109 loc) · 2.65 KB
/
workspace.impress208.patch
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# HG changeset patch
# User Christian Lippka ORACLE <christian.lippka@oracle.com>
# Date 1294074253 -3600
# Node ID 29638e31d01685727edd4569dd2438f914cdf538
# Parent a21d317bfa71988ffe2d6987083fd91f2f338800
impress208: #164349# fixed possible heap overflow when reading manipulated TGA images
diff -r a21d317bfa71 -r 29638e31d016 filter/source/graphicfilter/itga/itga.cxx
--- a/goodies/source/filter.vcl/itga/itga.cxx Mon Jan 03 17:59:57 2011 +0100
+++ b/goodies/source/filter.vcl/itga/itga.cxx Mon Jan 03 18:04:13 2011 +0100
@@ -338,6 +338,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -360,6 +363,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -387,6 +393,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -407,6 +416,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -440,6 +452,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -457,6 +472,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -483,6 +501,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -500,6 +521,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -528,6 +552,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}
@@ -548,6 +575,9 @@
nXCount = 0;
nY += nYAdd;
nYCount++;
+
+ if( nYCount >= mpFileHeader->nImageHeight )
+ return false; // invalid picture
}
}
}