diff options
| author | Michael Meeks <michael.meeks@suse.com> | 2013-03-05 11:48:32 +0000 |
|---|---|---|
| committer | Michael Meeks <michael.meeks@suse.com> | 2013-03-05 11:49:44 +0000 |
| commit | 0b789377ffc1a05b6c6a58e373900e378835e07e (patch) | |
| tree | bcea9c77ddf00022cefbb152b242d56c03cda7f4 /vcl/source/gdi/pngread.cxx | |
| parent | 41e03a166eb9077dddd3f0ee9c2602122ec7d5ba (diff) | |
fdo#61847 - tolerate invalid pngs.
Change-Id: I02a6460e9fa50c1c11e4f4c972bf962064d57410
Diffstat (limited to 'vcl/source/gdi/pngread.cxx')
| -rw-r--r-- | vcl/source/gdi/pngread.cxx | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx index 17cc412bfb12..bafafd56cd0b 100644 --- a/vcl/source/gdi/pngread.cxx +++ b/vcl/source/gdi/pngread.cxx @@ -259,12 +259,10 @@ bool PNGReaderImpl::ReadNextChunk() mrPNGStream >> mnChunkLen >> mnChunkType; rChunkData.nType = mnChunkType; - // #128377#/#149343# sanity check for chunk length - if( mnChunkLen < 0 ) - return false; + // fdo#61847 truncate over-long, trailing chunks const sal_Size nStreamPos = mrPNGStream.Tell(); - if( nStreamPos + mnChunkLen >= mnStreamSize ) - return false; + if( mnChunkLen < 0 || nStreamPos + mnChunkLen >= mnStreamSize ) + mnChunkLen = mnStreamSize - nStreamPos; // calculate chunktype CRC (swap it back to original byte order) sal_uInt32 nChunkType = mnChunkType; @@ -339,7 +337,8 @@ BitmapEx PNGReaderImpl::GetBitmapEx( const Size& rPreviewSizeHint ) } // parse the remaining chunks - while( mbStatus && !mbIDAT && ReadNextChunk() ) + bool bRetFromNextChunk; + while( mbStatus && !mbIDAT && (bRetFromNextChunk = ReadNextChunk()) ) { switch( mnChunkType ) { @@ -445,9 +444,7 @@ BitmapEx PNGReaderImpl::GetBitmapEx( const Size& rPreviewSizeHint ) aRet.SetPrefMapMode( MAP_100TH_MM ); aRet.SetPrefSize( maPhysSize ); } - } - return aRet; } |