diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-05-27 14:14:06 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-05-28 21:01:00 +0200 |
| commit | 8c4ca609c532b01c880d9803ba655c5688e5f0f1 (patch) | |
| tree | 216f92c7b938e12b4005cbf4b3902d3691382086 /vcl/source | |
| parent | 9ae3863f2afaa07abda6af11daf34bf6b808c3af (diff) | |
ofz#47673 skip oversized tiff images
Change-Id: I78727819b7c440855f89240f396dad845a295d61
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135041
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl/source')
| -rw-r--r-- | vcl/source/filter/itiff/itiff.cxx | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/vcl/source/filter/itiff/itiff.cxx b/vcl/source/filter/itiff/itiff.cxx index 6eac698121f0..59021b8c4999 100644 --- a/vcl/source/filter/itiff/itiff.cxx +++ b/vcl/source/filter/itiff/itiff.cxx @@ -136,8 +136,14 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) } } - size_t npixels = w * h; - std::vector<uint32_t> raster(npixels); + uint32_t nPixelsRequired; + if (o3tl::checked_multiply(w, h, nPixelsRequired)) + { + SAL_WARN("filter.tiff", "skipping oversized tiff image"); + break; + } + + std::vector<uint32_t> raster(nPixelsRequired); if (TIFFReadRGBAImageOriented(tif, w, h, raster.data(), ORIENTATION_TOPLEFT, 1)) { Bitmap bitmap(Size(w, h), vcl::PixelFormat::N24_BPP); |