detect loop in tif format

Change-Id: I27645566cd9fc0ac8cf753f0217ae6cf0fa9929e

2 files changed, 11 insertions, 1 deletions

diff --git a/filter/qa/cppunit/data/tiff/fail/loop.tif b/filter/qa/cppunit/data/tiff/fail/loop.tif
new file mode 100644
index 000000000000..6d8cee732e2c
--- /dev/null
+++ b/filter/qa/cppunit/data/tiff/fail/loop.tif
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 84bff7336f52..9ae2a0639eab 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1210,9 +1210,19 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
         }
         while( nOffset );
 
+        std::vector<sal_uInt32> aSeenIfds;
+
         for ( sal_uInt32 nNextIfd = nFirstIfd; nNextIfd && bStatus; )
         {
-            pTIFF->Seek( nOrigPos + nNextIfd );
+            if (std::find(aSeenIfds.begin(), aSeenIfds.end(), nNextIfd) != aSeenIfds.end())
+            {
+                SAL_WARN("filter.tiff", "Parsing error: " << nNextIfd <<
+                         " already processed, format loop");
+                bStatus = false;
+                break;
+            }
+            pTIFF->Seek(nOrigPos + nNextIfd);
+            aSeenIfds.push_back(nNextIfd);
             {
                 bByteSwap = false;