[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/crash-2.tiff |binary
 filter/source/graphicfilter/itiff/itiff.cxx   |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit fc3ba0cdd424e1ae2852ad9809b49a5e6e55b2f5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jul 19 21:25:46 2015 +0100

    check np bounds
    
    Change-Id: Id16ae9325f3c67792941b9c88d83435aa98282ca
    (cherry picked from commit be4e1141be7cd54cf5362d3de534050db5505437)
    Reviewed-on: https://gerrit.libreoffice.org/17199
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/qa/cppunit/data/tiff/fail/crash-2.tiff b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff
new file mode 100644
index 0000000..aadd99f
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 834c437..4599af9 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -608,6 +608,8 @@ bool TIFFReader::ReadMap()
                     pTIFF->Seek( pStripOffsets[ nStrip ] );
                     aCCIDecom.StartDecompression( *pTIFF );
                 }
+                if (np >= SAL_N_ELEMENTS(pMap))
+                    return false;
                 if ( !aCCIDecom.DecompressScanline( pMap[ np ], nImageWidth * nBitsPerSample * nSamplesPerPixel / nPlanes, np + 1 == nPlanes ) )
                     return false;
                 if ( pTIFF->GetError() )