lotuswordpro/source/filter/lwpdrawobj.cxx | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
New commits: commit 598525113d6e3deb28914dfd462d8273bcce0231 Author: Caolán McNamara <[email protected]> AuthorDate: Sun Jan 9 16:07:32 2022 +0000 Commit: Thorsten Behrens <[email protected]> CommitDate: Thu Feb 3 16:38:21 2022 +0100 ofz#43446 Undefined-shift Change-Id: Ibe3485983ecf764ca8b8e667b470c6b210b6d2d4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128192 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> (cherry picked from commit 27e9de358b4afc6a89b09c173316cee0abfb471d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128234 Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit fb5fe960e4d50176c754ae2d10ce53c3c3da82a1) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129412 Tested-by: Thorsten Behrens <[email protected]> Reviewed-by: Thorsten Behrens <[email protected]> diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 38e8c3162f08..98b5567037e1 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1344,6 +1344,22 @@ LwpDrawBitmap::~LwpDrawBitmap() { } +static bool IsValid(const BmpInfoHeader2& rHeader) +{ + if (rHeader.nPlanes != 1) + return false; + + if (rHeader.nBitCount != 0 && rHeader.nBitCount != 1 && + rHeader.nBitCount != 4 && rHeader.nBitCount != 8 && + rHeader.nBitCount != 16 && rHeader.nBitCount != 24 && + rHeader.nBitCount != 32) + { + return false; + } + + return true; +} + /** * @descr reading function of class LwpDrawBitmap */ @@ -1370,6 +1386,9 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); + if (!IsValid(aInfoHeader2)) + throw BadRead(); + N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; if (N == 24) { @@ -1386,6 +1405,10 @@ void LwpDrawBitmap::Read() m_pStream->ReadUInt32( aInfoHeader2.nHeight ); m_pStream->ReadUInt16( aInfoHeader2.nPlanes ); m_pStream->ReadUInt16( aInfoHeader2.nBitCount ); + + if (!IsValid(aInfoHeader2)) + throw BadRead(); + N = aInfoHeader2.nPlanes * aInfoHeader2.nBitCount; if (N == 24) {
