diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2023-05-12 15:44:03 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2023-05-12 17:57:02 +0200 |
| commit | c0fd5835c01e84d2351d60785e2e5fa33814e82e (patch) | |
| tree | 32e98cd392bd64784d808ef0feebbe9c134b8fa9 | |
| parent | 6be76f54a4e94b952975dfded25afff60257c6dd (diff) | |
ofz#58883 Out-of-memory
Change-Id: I91de8f537ae237de814ed7e933fb6d0a3cc98466
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151708
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | vcl/source/filter/itiff/itiff.cxx | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/vcl/source/filter/itiff/itiff.cxx b/vcl/source/filter/itiff/itiff.cxx index a31a1c384efd..439cbd856182 100644 --- a/vcl/source/filter/itiff/itiff.cxx +++ b/vcl/source/filter/itiff/itiff.cxx @@ -161,6 +161,16 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) bool bOk = !o3tl::checked_multiply(w, h, nPixelsRequired) && nPixelsRequired <= nMaxPixelsAllowed / 2; SAL_WARN_IF(!bOk, "filter.tiff", "skipping oversized tiff image " << w << " x " << h); + if (!TIFFIsTiled(tif)) + { + size_t nStripSize = TIFFStripSize(tif); + if (nStripSize > SAL_MAX_INT32) + { + SAL_WARN("filter.tiff", "skipping oversized tiff strip size " << nStripSize); + bOk = false; + } + } + if (bOk && bFuzzing) { const uint64_t MAX_PIXEL_SIZE = 120000000; |