From b79d0136b5246dcea637074cc742c37e8afa0cb9 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 1 Mar 2017 09:36:50 +0000 Subject: ofz#668: more complete fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit f01a975cb22d33a386bfd8db4ea6b4b77aceca1b. Change-Id: I18d11dcc137c20d54076e3c4117c10f2dd80efda Reviewed-on: https://gerrit.libreoffice.org/34738 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- filter/source/graphicfilter/itiff/ccidecom.cxx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'filter') diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 125d9c85d5e4..b5f3ab4cf529 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -627,7 +627,9 @@ void CCIDecompressor::StartDecompression( SvStream & rIStream ) bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTargetBits, bool bLastLine ) { - bool b2D; + //Read[1|2]DScanlineData take a sal_uInt16, so its either limit here or expand there + if (nTargetBits > SAL_MAX_UINT16) + return false; if ( nEOLCount >= 5 ) // RTC (Return To Controller) return true; @@ -682,6 +684,7 @@ bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTarget if ( nOptions & CCI_OPTION_BYTEALIGNROW ) nInputBitsBufSize &= 0xfff8; + bool b2D; // is it a 2D row? if ( nOptions & CCI_OPTION_2D ) { -- cgit