--- /dev/null	2010-12-31 18:16:37.629405698 +0100
+++ openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/security-fixes-from-cws-impress208.diff	2011-01-05 22:11:58.000000000 +0100
@@ -0,0 +1,112 @@
+
+# HG changeset patch
+# User Christian Lippka ORACLE <christian.lippka@oracle.com>
+# Date 1294074253 -3600
+# Node ID 29638e31d01685727edd4569dd2438f914cdf538
+# Parent  a21d317bfa71988ffe2d6987083fd91f2f338800
+impress208: #164349# fixed possible heap overflow when reading manipulated TGA images
+
+diff -r a21d317bfa71 -r 29638e31d016 filter/source/graphicfilter/itga/itga.cxx
+--- goodies/source/filter.vcl/itga/itga.cxx	Mon Jan 03 17:59:57 2011 +0100
++++ goodies/source/filter.vcl/itga/itga.cxx	Mon Jan 03 18:04:13 2011 +0100
+@@ -338,6 +338,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -360,6 +363,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -387,6 +393,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -407,6 +416,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -440,6 +452,9 @@
+ 										nXCount = 0;
+ 										nY += nYAdd;
+ 										nYCount++;
++
++										if( nYCount >= mpFileHeader->nImageHeight )
++											return false; // invalid picture
+ 									}
+ 								}
+ 							}
+@@ -457,6 +472,9 @@
+ 										nXCount = 0;
+ 										nY += nYAdd;
+ 										nYCount++;
++
++										if( nYCount >= mpFileHeader->nImageHeight )
++											return false; // invalid picture
+ 									}
+ 								}
+ 							}
+@@ -483,6 +501,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -500,6 +521,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -528,6 +552,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+@@ -548,6 +575,9 @@
+ 									nXCount = 0;
+ 									nY += nYAdd;
+ 									nYCount++;
++
++									if( nYCount >= mpFileHeader->nImageHeight )
++										return false; // invalid picture
+ 								}
+ 							}
+ 						}
+
--- openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/apply-old	2010-12-29 18:08:37.000000000 +0100
+++ openoffice.org-3.2.1/ooo-build-3-2-1-4/patches/dev300/apply	2011-01-05 22:25:56.000000000 +0100
@@ -4098,3 +4098,4 @@
 SA40775.diff
 cws-hb22.diff
 security-fixes-from-cws-os145.diff
+security-fixes-from-cws-impress208.diff
