From 74f181d285425bf7ec2ec8a18ad9f2e075f52594 Mon Sep 17 00:00:00 2001
From: Julien Nabet <serval2412@yahoo.fr>
Date: Sat, 7 Dec 2013 19:05:47 +0100
Subject: [PATCH 050/109] CID#736170, CID#736171, CID#736172 Out-of-Bounds
 read/write
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's be sure that nMaxcolorIndex < 256

Change-Id: I349184ad92c8e7b10a90a32e093972bfaee52467
Reviewed-on: https://gerrit.libreoffice.org/6970
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-on: https://gerrit.libreoffice.org/6972
---
 filter/source/graphicfilter/icgm/class5.cxx | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx
index c0319b7..eb53788 100644
--- a/filter/source/graphicfilter/icgm/class5.cxx
+++ b/filter/source/graphicfilter/icgm/class5.cxx
@@ -316,17 +316,16 @@ void CGM::ImplDoClass5()
                     if ( nMaxColorIndex > 255 )
                     {
                         mbStatus = sal_False;
+                        break;
                     }
-                    else
-                    {
-                        if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
-                            pElement->nLatestColorMaximumIndex = nMaxColorIndex;
+                    if ( pElement->nLatestColorMaximumIndex < nMaxColorIndex )
+                        pElement->nLatestColorMaximumIndex = nMaxColorIndex;
 
-                        for (  nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
-                        {
-                            pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
-                        }
+                    for (  nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
+                    {
+                        pElement->aLatestColorTable[ nIndex ] = ImplGetBitmapColor( sal_True );
                     }
+
                     pElement->nColorMaximumIndex = pElement->nLatestColorMaximumIndex;
                     for ( nIndex = nColorStartIndex; nIndex <= nMaxColorIndex; nIndex++ )
                     {
-- 
1.8.4.2