diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-23 12:02:06 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-27 12:54:40 +0000 |
| commit | dfdf256d828e29b430e41d1b82899680664259f5 (patch) | |
| tree | 5415fe63664aab46c20d1435ce58edc99687d1b8 /filter | |
| parent | 155886c99ba55ef28bd902cfe7256cbc1f4d2d01 (diff) | |
Resolves: ofz#668 check for massive row lengths before trying to allocate them
Change-Id: I7b3f1abf5dcf457e8ff7d04a7cf48ffee70817a2
Reviewed-on: https://gerrit.libreoffice.org/34571
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 4c4b10a3b825..e4afeb0c3d63 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -68,7 +68,7 @@ private: sal_uLong nSubFile; sal_Int32 nImageWidth; // picture width in pixels sal_Int32 nImageLength; // picture height in pixels - sal_uLong nBitsPerSample; // bits per pixel per layer + sal_uInt32 nBitsPerSample; // bits per pixel per layer sal_uLong nCompression; // kind of compression sal_uLong nPhotometricInterpretation; sal_uLong nThresholding; @@ -78,7 +78,7 @@ private: sal_uLong* pStripOffsets; // field of offsets to the Bitmap-Data-"Strips" sal_uLong nNumStripOffsets; // size of the field above sal_uLong nOrientation; - sal_uLong nSamplesPerPixel; // number of layers + sal_uInt32 nSamplesPerPixel; // number of layers sal_uLong nRowsPerStrip; // if it's not compressed: number of rows per Strip sal_uLong* pStripByteCounts; // if compressed (in a certain way): size of the strips sal_uLong nNumStripByteCounts; // number of entries in the field above @@ -94,9 +94,9 @@ private: std::unique_ptr<sal_uInt32[]> xColorMap; // color palette sal_uLong nNumColors; // number of colors within the color palette - sal_uLong nPlanes; // number of layers within the Tiff file + sal_uInt32 nPlanes; // number of layers within the Tiff file sal_uLong nStripsPerPlane; // number of Strips per layer - sal_uLong nBytesPerRow; // Bytes per line per Layer in the Tiff file ( uncompressed ) + sal_uInt32 nBytesPerRow; // Bytes per line per Layer in the Tiff file ( uncompressed ) sal_uInt8* pMap[ 4 ]; // temporary Scanline @@ -1368,8 +1368,18 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) if (bStatus) { - nBytesPerRow = ( nImageWidth * nSamplesPerPixel / nPlanes * nBitsPerSample + 7 ) >> 3; + sal_uInt64 nRowSize = (static_cast<sal_uInt64>(nImageWidth) * nSamplesPerPixel / nPlanes * nBitsPerSample + 7) >> 3; + if (nRowSize > SAL_MAX_INT32 / SAL_N_ELEMENTS(pMap)) + { + SAL_WARN("filter.tiff", "Ludicrous row size of: " << nRowSize << " required"); + bStatus = false; + } + else + nBytesPerRow = nRowSize; + } + if (bStatus) + { for (sal_uInt8*& j : pMap) { try |