coverity#1242658 Untrusted loop bound

Change-Id: Ib37d08e5c55ca3c9f054684aa79dbe38d441f37a

filter/source/graphicfilter/ipict/ipict.cxx

@@ -758,9 +758,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             pPict->SeekRel( 6 );
             pPict->ReadUInt16( nColTabSize );
 
-            if ( ++nColTabSize > 256 )
+            if (nColTabSize > 255)
                 BITMAPERROR;
 
+            ++nColTabSize;
+
             pAcc->SetPaletteEntryCount( nColTabSize );
 
             for ( i = 0; i < nColTabSize; i++ )
@@ -1001,6 +1003,11 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         }
         else if ( nPackType == 2 )
         {
+            const size_t nMaxPixels = pPict->remainingSize() / 3;
+            const size_t nMaxRows = nMaxPixels / nWidth;
+            if (nHeight > nMaxRows)
+                BITMAPERROR;
+
             for ( ny = 0; ny < nHeight; ny++ )
             {
                 for ( nx = 0; nx < nWidth; nx++ )