diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-12-02 09:26:54 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-12-02 16:45:43 +0100 |
| commit | a9665403cd997c1c593efc52682a87ffb3c1e87a (patch) | |
| tree | 6f4c73a1dbae64762fbef35d6466df25fcc8d559 /filter | |
| parent | 2e2b97f0c919afffb262bfed7058c91264c3107c (diff) | |
ofz#27839 Timeout
use sal_uInt32 and truncate to limit instead of using sal_uInt16
Change-Id: I454fcf23ff272069f8e4499b1ce9674cfb8e4564
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107068
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/ccidecom.cxx | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 9c9b916a1d8c..407aab17d669 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -871,12 +871,12 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits, } sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits, - sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) + sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) { // here the number of bits belonging together is being counted // which all have the color nBlackOrWhite (0xff or 0x00) // from the position nBitPos on - sal_uInt16 nPos = nBitPos; + sal_uInt32 nPos = nBitPos; for (;;) { if (nPos>=nDataSizeBits) @@ -888,9 +888,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataS sal_uInt16 nLo = nPos & 7; if (nLo==0 && nData==nBlackOrWhite) { - //fail on overflow attempt - if (nPos > SAL_MAX_UINT16-8) - return 0; nPos+=8; } else @@ -900,8 +897,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataS ++nPos; } } - if (nPos<=nBitPos) - return 0; return nPos-nBitPos; } |