diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-02-15 14:06:41 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-15 21:51:13 +0100 |
| commit | 1cde1dd46b04321721fc9f474acec706ccc7961b (patch) | |
| tree | 1bf7de08852f3e3c559d05315dac063b6ad3ce1b | |
| parent | 6864b7d9b72d85cc7f8be19136708eaebae1bfe4 (diff) | |
ofz#6345 Integer-overflow
Change-Id: I537b49bac053c0f55bbbc26b0d37dfae4c62106a
Reviewed-on: https://gerrit.libreoffice.org/49817
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 24b6c7143863..83285b922cf7 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1520,10 +1520,21 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) } } + sal_Int32 nImageDataSize(0); + if (bStatus) + { + if (o3tl::checked_multiply<sal_Int32>(nImageWidth, nImageLength, nImageDataSize) || + o3tl::checked_multiply<sal_Int32>(nImageDataSize, (HasAlphaChannel() ? 4 : 3), nImageDataSize) || + nImageDataSize > SAL_MAX_INT32/2) + { + bStatus = false; + } + } + if ( bStatus ) { maBitmapPixelSize = Size(nImageWidth, nImageLength); - mpBitmap.reset(new sal_uInt8[nImageWidth * nImageLength * (HasAlphaChannel() ? 4 : 3)]); + mpBitmap.reset(new sal_uInt8[nImageDataSize]); if (bStatus && ReadMap()) { |