filter/qa/cppunit/data/tiff/fail/hang-10.tiff |binary filter/source/graphicfilter/itiff/lzwdecom.cxx | 12 ++++++++++++ 2 files changed, 12 insertions(+)
New commits: commit 6b82437dca30eba0f0c9dde6fdc84cb8f7740f8f Author: Caolán McNamara <[email protected]> Date: Mon Aug 24 15:31:41 2015 +0100 detect and reject loop in tif Change-Id: I77d315fa432a3eb1a65539489a2ba6da8508b283 diff --git a/filter/qa/cppunit/data/tiff/fail/hang-10.tiff b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff new file mode 100644 index 0000000..e5e9ebc Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff differ diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx b/filter/source/graphicfilter/itiff/lzwdecom.cxx index 82f6acc..5fb7514 100644 --- a/filter/source/graphicfilter/itiff/lzwdecom.cxx +++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx @@ -19,6 +19,8 @@ #include "lzwdecom.hxx" +#include <algorithm> +#include <vector> #define MAX_TABLE_SIZE 4096 @@ -161,8 +163,18 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData return; } + std::vector<sal_uInt16> aSeenIndexes; while (pTable[nCodeFirstData].nDataCount>1) + { + if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(), nCodeFirstData) != aSeenIndexes.end()) + { + SAL_WARN("filter.tiff", "Loop in chain"); + bEOIFound = true; + return; + } + aSeenIndexes.push_back(nCodeFirstData); nCodeFirstData=pTable[nCodeFirstData].nPrevCode; + } pTable[nTableSize].nPrevCode=nPrevCode; pTable[nTableSize].nDataCount=pTable[nPrevCode].nDataCount+1;
_______________________________________________ Libreoffice-commits mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
