From 8b053a3c88c2b3e203856dbd9dabca6c935b0bde Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Sat, 30 Sep 2017 21:22:27 +0100 Subject: ofz#3532 avoid oom MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Ic046ebcb4c312716997eba9c18079db59c0b41f6 Reviewed-on: https://gerrit.libreoffice.org/42974 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- filter/source/graphicfilter/itiff/itiff.cxx | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index ecda46305201..e9f07689387c 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1434,6 +1434,29 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) bStatus = false; } } + else if ( nCompression == 5 ) + { + sal_uInt32 np = nPlanes - 1; + if (np >= SAL_N_ELEMENTS(aMap)) + bStatus = false; + sal_Int32 ny = nImageLength - 1; + sal_uInt32 nStrip(0); + nDiv = GetRowsPerStrip(); + if (bStatus) + bStatus = nDiv != 0; + if (bStatus) + { + nStrip = ny / nDiv + np * nStripsPerPlane; + if (nStrip >= aStripOffsets.size()) + bStatus = false; + } + if (bStatus) + { + auto nStart = aStripOffsets[nStrip]; + if (nStart > nEndOfFile) + bStatus = false; + } + } } if ( bStatus ) -- cgit