diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-03-02 10:30:52 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-02 10:50:13 +0000 |
| commit | 82070481f34091718ee0ca0dd97826c7e3d7d79e (patch) | |
| tree | 00976b43fc9cedcdedb039024c8769e7302cd7d7 | |
| parent | d0f99b1b39027bcf0fae1b130b60a4c837e854d8 (diff) | |
reject bmps with unknown compression schemes
and RLE8/RLE4 compression with wrong bitmap depth
Change-Id: I7e580cb119e90262a88c57b86f562eaba81c4944
| -rw-r--r-- | vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf (renamed from vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf) | bin | 4192 -> 4192 bytes | |||
| -rw-r--r-- | vcl/source/gdi/dibtools.cxx | 28 |
2 files changed, 22 insertions, 6 deletions
diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf Binary files differindex 1512a2256bc2..1512a2256bc2 100644 --- a/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf +++ b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx index 8dd710e5dab1..7218e8fdde14 100644 --- a/vcl/source/gdi/dibtools.cxx +++ b/vcl/source/gdi/dibtools.cxx @@ -867,13 +867,29 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, AlphaMask* pBmpAlpha, sal_u return false; const sal_uInt64 nAlignedWidth(AlignedWidth4Bytes(static_cast<sal_uLong>(nBitsPerLine))); - // (partially) check the image dimensions to avoid potential large bitmap allocation if the input is damaged - if (aHeader.nCompression == ZCOMPRESS || aHeader.nCompression == COMPRESS_NONE) + switch (aHeader.nCompression) { - sal_uInt64 nMaxWidth = pIStm->remainingSize(); - if (aHeader.nHeight != 0) - nMaxWidth /= aHeader.nHeight; - if (nMaxWidth < nAlignedWidth) + case RLE_8: + if (aHeader.nBitCount != 8) + return false; + break; + case RLE_4: + if (aHeader.nBitCount != 4) + return false; + case BITFIELDS: + break; + case ZCOMPRESS: + case COMPRESS_NONE: + { + // (partially) check the image dimensions to avoid potential large bitmap allocation if the input is damaged + sal_uInt64 nMaxWidth = pIStm->remainingSize(); + if (aHeader.nHeight != 0) + nMaxWidth /= aHeader.nHeight; + if (nMaxWidth < nAlignedWidth) + return false; + break; + } + default: return false; } |