vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png |binary vcl/source/filter/png/PngImageReader.cxx | 21 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
New commits: commit 76546f678e86b5c551f3dfe28f35864cebdd2019 Author: Caolán McNamara <[email protected]> AuthorDate: Sat Mar 13 19:51:14 2021 +0000 Commit: Caolán McNamara <[email protected]> CommitDate: Sun Mar 14 22:01:54 2021 +0100 ofz#32026 null-deref Change-Id: I9bb0e75a91c3646b86be24954249c319b63f6a2a Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112462 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png b/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png new file mode 100644 index 000000000000..290671ecb43d Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png differ diff --git a/vcl/source/filter/png/PngImageReader.cxx b/vcl/source/filter/png/PngImageReader.cxx index b1e8e10cdc1d..32231de9e03f 100644 --- a/vcl/source/filter/png/PngImageReader.cxx +++ b/vcl/source/filter/png/PngImageReader.cxx @@ -190,6 +190,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32) aBitmap = Bitmap(Size(width, height), vcl::PixelFormat::N24_BPP); { pWriteAccess = BitmapScopedWriteAccess(aBitmap); + if (!pWriteAccess) + { + png_destroy_read_struct(&pPng, &pInfo, nullptr); + return false; + } ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat(); if (eFormat == ScanlineFormat::N24BitTcBgr) png_set_bgr(pPng); @@ -227,6 +232,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32) aBitmap = Bitmap(Size(width, height), vcl::PixelFormat::N32_BPP); { pWriteAccess = BitmapScopedWriteAccess(aBitmap); + if (!pWriteAccess) + { + png_destroy_read_struct(&pPng, &pInfo, nullptr); + return false; + } ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat(); if (eFormat == ScanlineFormat::N32BitTcAbgr || eFormat == ScanlineFormat::N32BitTcBgra) @@ -275,6 +285,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32) aBitmapAlpha = AlphaMask(Size(width, height), nullptr); { pWriteAccess = BitmapScopedWriteAccess(aBitmap); + if (!pWriteAccess) + { + png_destroy_read_struct(&pPng, &pInfo, nullptr); + return false; + } ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat(); if (eFormat == ScanlineFormat::N24BitTcBgr) png_set_bgr(pPng); @@ -319,7 +334,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32) aBitmap.Erase(COL_WHITE); { pWriteAccess = BitmapScopedWriteAccess(aBitmap); - + if (!pWriteAccess) + { + png_destroy_read_struct(&pPng, &pInfo, nullptr); + return false; + } aRows = std::vector<std::vector<png_byte>>(height); for (auto& rRow : aRows) rRow.resize(aRowSizeBytes, 0); _______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
