[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 dev/null                                            |binary
 filter/qa/cppunit/data/ras/fail/CVE-2008-1097-1.ras |binary
 filter/source/graphicfilter/iras/iras.cxx           |   24 +++++++++++---------
 3 files changed, 14 insertions(+), 10 deletions(-)

New commits:
commit 2be3b3ee4b94f2b0f25985db931f8981699e784c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jul 15 11:31:18 2015 +0100

    check stream state more often for failures
    
    Change-Id: Ie45d858021c3123ec21829cbf4742cf30ce46665
    (cherry picked from commit adfa89b5ffc3589b3a19a32e707a134cee232429)
    Reviewed-on: https://gerrit.libreoffice.org/17072
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/qa/cppunit/data/ras/pass/CVE-2008-1097-1.ras b/filter/qa/cppunit/data/ras/fail/CVE-2008-1097-1.ras
similarity index 100%
rename from filter/qa/cppunit/data/ras/pass/CVE-2008-1097-1.ras
rename to filter/qa/cppunit/data/ras/fail/CVE-2008-1097-1.ras
diff --git a/filter/source/graphicfilter/iras/iras.cxx b/filter/source/graphicfilter/iras/iras.cxx
index 2f441cf..61d5128 100644
--- a/filter/source/graphicfilter/iras/iras.cxx
+++ b/filter/source/graphicfilter/iras/iras.cxx
@@ -54,7 +54,7 @@ private:
 
     bool                ImplReadBody(BitmapWriteAccess * pAcc);
     bool                ImplReadHeader();
-    sal_uInt8               ImplGetByte();
+    sal_uInt8           ImplGetByte();
 
 public:
                         RASReader(SvStream &rRAS);
@@ -174,13 +174,11 @@ bool RASReader::ReadRAS(Graphic & rGraphic)
     return mbStatus;
 }
 
-
-
 bool RASReader::ImplReadHeader()
 {
     m_rRAS.ReadInt32(mnWidth).ReadInt32(mnHeight).ReadInt32(mnDepth).ReadInt32(mnImageDatSize).ReadInt32(mnType).ReadInt32(mnColorMapType).ReadInt32(mnColorMapSize);
 
-    if ( mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0 )
+    if (mnWidth <= 0 || mnHeight <= 0 || mnImageDatSize <= 0 || !m_rRAS.good())
         mbStatus = false;
 
     switch ( mnDepth )
@@ -222,7 +220,7 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
     switch ( mnDstBitsPerPix )
     {
         case 1 :
-            for ( y = 0; y < mnHeight; y++ )
+            for (y = 0; y < mnHeight && mbStatus; ++y)
             {
                 for ( x = 0; x < mnWidth; x++ )
                 {
@@ -233,11 +231,13 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
                             nDat >> ( ( x & 7 ) ^ 7 )) );
                 }
                 if (!( ( x - 1 ) & 0x8 ) ) ImplGetByte();       // WORD ALIGNMENT ???
+                if (!m_rRAS.good())
+                    mbStatus = false;
             }
             break;
 
         case 8 :
-            for ( y = 0; y < mnHeight; y++ )
+            for (y = 0; y < mnHeight && mbStatus; ++y)
             {
                 for ( x = 0; x < mnWidth; x++ )
                 {
@@ -245,6 +245,8 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
                     pAcc->SetPixelIndex( y, x, nDat );
                 }
                 if ( x & 1 ) ImplGetByte();                     // WORD ALIGNMENT ???
+                if (!m_rRAS.good())
+                    mbStatus = false;
             }
             break;
 
@@ -253,7 +255,7 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
             {
 
                 case 24 :
-                    for ( y = 0; y < mnHeight; y++ )
+                    for (y = 0; y < mnHeight && mbStatus; ++y)
                     {
                         for ( x = 0; x < mnWidth; x++ )
                         {
@@ -272,11 +274,13 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
                             pAcc->SetPixel ( y, x, BitmapColor( nRed, nGreen, nBlue ) );
                         }
                         if ( x & 1 ) ImplGetByte();                     // WORD ALIGNMENT ???
+                        if (!m_rRAS.good())
+                            mbStatus = false;
                     }
                     break;
 
                 case 32 :
-                    for ( y = 0; y < mnHeight; y++ )
+                    for (y = 0; y < mnHeight && mbStatus; ++y)
                     {
                         for ( x = 0; x < mnWidth; x++ )
                         {
@@ -295,6 +299,8 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
                             }
                             pAcc->SetPixel ( y, x, BitmapColor( nRed, nGreen, nBlue ) );
                         }
+                        if (!m_rRAS.good())
+                            mbStatus = false;
                     }
                     break;
             }
@@ -307,8 +313,6 @@ bool RASReader::ImplReadBody(BitmapWriteAccess * pAcc)
     return mbStatus;
 }
 
-
-
 sal_uInt8 RASReader::ImplGetByte()
 {
     sal_uInt8 nRetVal;