Commits

Christian Lippka ORACLE  committed 29638e3

impress208: #164349# fixed possible heap overflow when reading manipulated TGA images

  • Participants
  • Parent commits a21d317

Comments (0)

Files changed (1)

File filter/source/graphicfilter/itga/itga.cxx

 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 										nXCount = 0;
 										nY += nYAdd;
 										nYCount++;
+
+										if( nYCount >= mpFileHeader->nImageHeight )
+											return false; // invalid picture
 									}
 								}
 							}
 										nXCount = 0;
 										nY += nYAdd;
 										nYCount++;
+
+										if( nYCount >= mpFileHeader->nImageHeight )
+											return false; // invalid picture
 									}
 								}
 							}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}
 									nXCount = 0;
 									nY += nYAdd;
 									nYCount++;
+
+									if( nYCount >= mpFileHeader->nImageHeight )
+										return false; // invalid picture
 								}
 							}
 						}