From 1890b577d99d571e52570fa6b3e8b36b46a0bbba Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 6 Nov 2017 09:55:42 +0000
Subject: ofz#4076 bad palette READ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I54943d96baa6e2309bbf2cd3b6d8bcada2b76952
Reviewed-on: https://gerrit.libreoffice.org/44351
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 vcl/source/gdi/pngread.cxx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'vcl')

diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index a29ed669d048..f2169e01d337 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -126,6 +126,7 @@ private:
     bool                mbGrayScale : 1;
     bool                mbzCodecInUse : 1;
     bool                mbStatus : 1;
+    bool                mbIDATStarted : 1;  // true if IDAT seen
     bool                mbIDATComplete : 1; // true if finished with enough IDAT chunks
     bool                mbpHYs : 1;         // true if physical size of pixel available
     bool                mbIgnoreGammaChunk : 1;
@@ -205,6 +206,7 @@ PNGReaderImpl::PNGReaderImpl( SvStream& rPNGStream )
     mbGrayScale( false ),
     mbzCodecInUse   ( false ),
     mbStatus( true ),
+    mbIDATStarted( false ),
     mbIDATComplete( false ),
     mbpHYs              ( false ),
     mbIgnoreGammaChunk  ( false ),
@@ -360,7 +362,7 @@ BitmapEx PNGReaderImpl::GetBitmapEx( const Size& rPreviewSizeHint )
 
             case PNGCHUNK_PLTE :
             {
-                if ( !mbPalette )
+                if (!mbPalette && !mbIDATStarted)
                     mbStatus = ImplReadPalette();
             }
             break;
@@ -479,7 +481,7 @@ bool PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
     }
 
     mbPalette = true;
-    mbIDATComplete = mbAlphaChannel = mbTransparent = false;
+    mbIDATStarted = mbIDATComplete = mbAlphaChannel = mbTransparent = false;
     mbGrayScale = mbRGBTriple = false;
     mnTargetDepth = mnPngDepth;
     sal_uInt64 nScansize64 = ( ( static_cast< sal_uInt64 >( maOrigSize.Width() ) * mnPngDepth ) + 7 ) >> 3;
@@ -892,6 +894,8 @@ void PNGReaderImpl::ImplReadIDAT()
 {
     if( mnChunkLen > 0 )
     {
+        mbIDATStarted = true;
+
         if ( !mbzCodecInUse )
         {
             mbzCodecInUse = true;
-- 
cgit