diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 10:06:59 +0100 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 10:28:30 +0100 |
commit | c02e79874951ba86d926186e284612806d8bc0a3 (patch) | |
tree | c997a65da70d1ed1bb9c8a667bb56aa389463139 /filter | |
parent | ff3a3bfd4bbd2fdabea887e1739faacd79aefa64 (diff) |
ensure loop ends eventually
Change-Id: I318385286fcc27ffb2d938237d83e793564d2525
Diffstat (limited to 'filter')
-rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-6.tiff | bin | 0 -> 259 bytes | |||
-rw-r--r-- | filter/source/graphicfilter/itiff/ccidecom.cxx | 39 |
2 files changed, 22 insertions, 17 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-6.tiff b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff Binary files differnew file mode 100644 index 000000000000..4e6cc0ed5d4b --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 2f767777e821..4a49f73db133 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -886,36 +886,41 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits, } } - sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits, sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) { - sal_uInt16 nPos,nLo; - sal_uInt8 nData; - // here the number of bits belonging together is being counted // which all have the color nBlackOrWhite (0xff oder 0x00) // from the position nBitPos on - - nPos=nBitPos; - for (;;) { - if (nPos>=nDataSizeBits) { + sal_uInt16 nPos = nBitPos; + for (;;) + { + if (nPos>=nDataSizeBits) + { nPos=nDataSizeBits; break; } - nData=pData[nPos>>3]; - nLo=nPos & 7; - if ( nLo==0 && nData==nBlackOrWhite) nPos+=8; - else { - if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) break; - nPos++; + sal_uInt8 nData = pData[nPos>>3]; + sal_uInt16 nLo = nPos & 7; + if (nLo==0 && nData==nBlackOrWhite) + { + //fail on overflow attempt + if (nPos > SAL_MAX_UINT16-8) + return 0; + nPos+=8; + } + else + { + if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) + break; + ++nPos; } } - if (nPos<=nBitPos) return 0; - else return nPos-nBitPos; + if (nPos<=nBitPos) + return 0; + return nPos-nBitPos; } - void CCIDecompressor::Read1DScanlineData(sal_uInt8 * pTarget, sal_uInt16 nTargetBits) { sal_uInt16 nCode,nCodeBits,nDataBits,nTgtFreeByteBits; |