filter/qa/cppunit/data/tiff/fail/crash-6.tiff |binary filter/source/graphicfilter/itiff/itiff.cxx | 2 ++ 2 files changed, 2 insertions(+)
New commits: commit dcbbe7741a08f6076f9e020f90cbb730c1edafb9 Author: Caolán McNamara <[email protected]> Date: Mon Jul 20 09:24:48 2015 +0100 final check np bounds Change-Id: I9213bb2cc059e05e286598edac03bd72c84db876 diff --git a/filter/qa/cppunit/data/tiff/fail/crash-6.tiff b/filter/qa/cppunit/data/tiff/fail/crash-6.tiff new file mode 100644 index 0000000..907b510 Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-6.tiff differ diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 89de8e0..f0c5d1e 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -554,6 +554,8 @@ bool TIFFReader::ReadMap() if ( nStrip >= nNumStripOffsets ) return false; pTIFF->Seek( pStripOffsets[ nStrip ] + ( ny % GetRowsPerStrip() ) * nStripBytesPerRow ); + if (np >= SAL_N_ELEMENTS(pMap)) + return false; pTIFF->Read( pMap[ np ], nBytesPerRow ); if ( pTIFF->GetError() ) return false;
_______________________________________________ Libreoffice-commits mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
