filter/source/graphicfilter/itiff/itiff.cxx | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
New commits: commit 8b053a3c88c2b3e203856dbd9dabca6c935b0bde Author: Caolán McNamara <[email protected]> Date: Sat Sep 30 21:22:27 2017 +0100 ofz#3532 avoid oom Change-Id: Ic046ebcb4c312716997eba9c18079db59c0b41f6 Reviewed-on: https://gerrit.libreoffice.org/42974 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index ecda46305201..e9f07689387c 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1434,6 +1434,29 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) bStatus = false; } } + else if ( nCompression == 5 ) + { + sal_uInt32 np = nPlanes - 1; + if (np >= SAL_N_ELEMENTS(aMap)) + bStatus = false; + sal_Int32 ny = nImageLength - 1; + sal_uInt32 nStrip(0); + nDiv = GetRowsPerStrip(); + if (bStatus) + bStatus = nDiv != 0; + if (bStatus) + { + nStrip = ny / nDiv + np * nStripsPerPlane; + if (nStrip >= aStripOffsets.size()) + bStatus = false; + } + if (bStatus) + { + auto nStart = aStripOffsets[nStrip]; + if (nStart > nEndOfFile) + bStatus = false; + } + } } if ( bStatus )
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
