diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-09-24 13:08:55 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-09-24 17:15:30 +0200 |
| commit | 384f37c0624784dea32dabb813aba937430b22be (patch) | |
| tree | 563e967b0d7483144a79fc1b5e56bb79462b949d /filter | |
| parent | d70988e4e3e4e9be71608242890c4a81c899cfd5 (diff) | |
ofz#3476 oom in tiff reader
Change-Id: Id103488ea0774b55521571f8b51059d06d4a0993
Reviewed-on: https://gerrit.libreoffice.org/42707
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 9e5c6c62cfc0..083143600fc0 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1366,6 +1366,38 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) if ( bStatus ) { + //sanity check consider ReadMap condition for last row and + //last plane + if (nCompression == 1 || nCompression == 32771) + { + sal_uInt32 nStripBytesPerRow; + if (nCompression == 1) + nStripBytesPerRow = nBytesPerRow; + else + nStripBytesPerRow = ( nBytesPerRow + 1 ) & 0xfffffffe; + sal_uInt32 np = nPlanes - 1; + if (np >= SAL_N_ELEMENTS(aMap)) + bStatus = false; + sal_Int32 ny = nImageLength - 1; + sal_uInt32 nStrip(0); + if (bStatus) + { + nStrip = ny / GetRowsPerStrip() + np * nStripsPerPlane; + if (nStrip >= aStripOffsets.size()) + bStatus = false; + } + if (bStatus) + { + auto nStart = aStripOffsets[ nStrip ] + ( ny % GetRowsPerStrip() ) * nStripBytesPerRow; + auto nEnd = nStart + nBytesPerRow; + if (nEnd > nEndOfFile) + bStatus = false; + } + } + } + + if ( bStatus ) + { pAlphaMask.reset(); Size aTargetSize(nImageWidth, nImageLength); aBitmap = Bitmap(aTargetSize, nDstBitsPerPixel); |