diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-09-30 21:22:27 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-01 00:34:04 +0200 |
| commit | 8b053a3c88c2b3e203856dbd9dabca6c935b0bde (patch) | |
| tree | 96ad2c0ed6dcc16608249226a015e17b5424f25c | |
| parent | 1d0fbc9927f357d25859b7cca7ea5e9a9637681e (diff) | |
ofz#3532 avoid oom
Change-Id: Ic046ebcb4c312716997eba9c18079db59c0b41f6
Reviewed-on: https://gerrit.libreoffice.org/42974
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index ecda46305201..e9f07689387c 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1434,6 +1434,29 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) bStatus = false; } } + else if ( nCompression == 5 ) + { + sal_uInt32 np = nPlanes - 1; + if (np >= SAL_N_ELEMENTS(aMap)) + bStatus = false; + sal_Int32 ny = nImageLength - 1; + sal_uInt32 nStrip(0); + nDiv = GetRowsPerStrip(); + if (bStatus) + bStatus = nDiv != 0; + if (bStatus) + { + nStrip = ny / nDiv + np * nStripsPerPlane; + if (nStrip >= aStripOffsets.size()) + bStatus = false; + } + if (bStatus) + { + auto nStart = aStripOffsets[nStrip]; + if (nStart > nEndOfFile) + bStatus = false; + } + } } if ( bStatus ) |