diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2022-11-17 12:28:41 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2022-11-17 17:13:13 +0100 |
| commit | 3b6316f25e6679aeaf70740acbaf8bb4a68bbece (patch) | |
| tree | c43003a8949e491bdc989d03caa4d9ad4bc7d667 /vcl | |
| parent | f44f5f12605f32d92c2c1689e3e6888337eca2d9 (diff) | |
ofz#53452 Out-of-memory
Change-Id: I12e9a87f675d2e625a49d9736bca331a1d3879c0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142837
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/itiff/itiff.cxx | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/vcl/source/filter/itiff/itiff.cxx b/vcl/source/filter/itiff/itiff.cxx index 3e308f3019d3..ed74d00ddeb9 100644 --- a/vcl/source/filter/itiff/itiff.cxx +++ b/vcl/source/filter/itiff/itiff.cxx @@ -184,6 +184,25 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) } } } + + uint16_t Compression; + if (TIFFGetField(tif, TIFFTAG_COMPRESSION, &Compression) == 1) + { + if (Compression == COMPRESSION_CCITTFAX4) + { + if (TIFFIsTiled(tif)) + { + uint32_t tw; + if (TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw) == 1) + { + uint32_t DspRuns; + bOk = !o3tl::checked_multiply(tw, static_cast<uint32_t>(4), DspRuns) && DspRuns < MAX_PIXEL_SIZE; + SAL_WARN_IF(!bOk, "filter.tiff", "skipping oversized tiff tile width: " << tw); + } + } + } + } + } if (!bOk) |