[Libreoffice-commits] core.git: filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/hang-10.tiff  |binary
 filter/source/graphicfilter/itiff/lzwdecom.cxx |   12 ++++++++++++
 2 files changed, 12 insertions(+)

New commits:
commit 6b82437dca30eba0f0c9dde6fdc84cb8f7740f8f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 24 15:31:41 2015 +0100

    detect and reject loop in tif
    
    Change-Id: I77d315fa432a3eb1a65539489a2ba6da8508b283

diff --git a/filter/qa/cppunit/data/tiff/fail/hang-10.tiff b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff
new file mode 100644
index 0000000..e5e9ebc
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff differ
diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx b/filter/source/graphicfilter/itiff/lzwdecom.cxx
index 82f6acc..5fb7514 100644
--- a/filter/source/graphicfilter/itiff/lzwdecom.cxx
+++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx
@@ -19,6 +19,8 @@
 
 
 #include "lzwdecom.hxx"
+#include <algorithm>
+#include <vector>
 
 #define MAX_TABLE_SIZE 4096
 
@@ -161,8 +163,18 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData
         return;
     }
 
+    std::vector<sal_uInt16> aSeenIndexes;
     while (pTable[nCodeFirstData].nDataCount>1)
+    {
+        if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(), nCodeFirstData) != aSeenIndexes.end())
+        {
+            SAL_WARN("filter.tiff", "Loop in chain");
+            bEOIFound = true;
+            return;
+        }
+        aSeenIndexes.push_back(nCodeFirstData);
         nCodeFirstData=pTable[nCodeFirstData].nPrevCode;
+    }
 
     pTable[nTableSize].nPrevCode=nPrevCode;
     pTable[nTableSize].nDataCount=pTable[nPrevCode].nDataCount+1;