[Libreoffice-commits] core.git: filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/crash-5.tiff |binary
 filter/source/graphicfilter/itiff/itiff.cxx   |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit bca4d6f896fb12ceff37476c43ea8892898dd385
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 20 08:50:27 2015 +0100

    check np bounds yet again
    
    Change-Id: Id3f6fdc0ebed9711acec5d71f404e7a6072b765c

diff --git a/filter/qa/cppunit/data/tiff/fail/crash-5.tiff b/filter/qa/cppunit/data/tiff/fail/crash-5.tiff
new file mode 100644
index 0000000..4849edf
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-5.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index b18db6b..7a5d487 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -669,6 +669,8 @@ bool TIFFReader::ReadMap()
                     pTIFF->Seek(pStripOffsets[nStrip]);
                 }
                 nRowBytesLeft = nBytesPerRow;
+                if (np >= SAL_N_ELEMENTS(pMap))
+                    return false;
                 pdst=pMap[ np ];
                 do
                 {