diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-19 21:32:05 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-07-19 21:33:37 +0100 |
| commit | fcdddbd30a8b5cf6a5cc4d2ff28b7d4a20f8ec6b (patch) | |
| tree | 6fbea3f747449302dc5b424cbce68ad56248661a | |
| parent | 3b0aae379e77dade4bde1f832225728ce6214816 (diff) | |
check np bounds again
Change-Id: I0fb61954b2eaf0c015d7bdefe9f03bd459b31501
| -rw-r--r-- | filter/qa/cppunit/data/tiff/fail/crash-3.tiff | bin | 0 -> 260 bytes | |||
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 2 |
2 files changed, 2 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-3.tiff b/filter/qa/cppunit/data/tiff/fail/crash-3.tiff Binary files differnew file mode 100644 index 000000000000..4aa2393ade25 --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/crash-3.tiff diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 0913fd1dd9e9..b18db6b9be3b 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -640,6 +640,8 @@ bool TIFFReader::ReadMap() pTIFF->Seek(pStripOffsets[nStrip]); aLZWDecom.StartDecompression(*pTIFF); } + if (np >= SAL_N_ELEMENTS(pMap)) + return false; if ( ( aLZWDecom.Decompress( pMap[ np ], nBytesPerRow ) != nBytesPerRow ) || pTIFF->GetError() ) return false; } |