[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/hang-6.tiff   |binary
 filter/source/graphicfilter/itiff/ccidecom.cxx |   39 ++++++++++++++-----------
 2 files changed, 22 insertions(+), 17 deletions(-)

New commits:
commit 29ab9be99e3a537ad1de857ab9c868adc0b0aca7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 20 10:06:59 2015 +0100

    ensure loop ends eventually
    
    Change-Id: I318385286fcc27ffb2d938237d83e793564d2525
    (cherry picked from commit c02e79874951ba86d926186e284612806d8bc0a3)
    Reviewed-on: https://gerrit.libreoffice.org/17215
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/qa/cppunit/data/tiff/fail/hang-6.tiff b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff
new file mode 100644
index 0000000..4e6cc0e
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff differ
diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx
index de0299f..4752aa0 100644
--- a/filter/source/graphicfilter/itiff/ccidecom.cxx
+++ b/filter/source/graphicfilter/itiff/ccidecom.cxx
@@ -886,36 +886,41 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits,
     }
 }
 
-
 sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits,
                                   sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite)
 {
-    sal_uInt16 nPos,nLo;
-    sal_uInt8 nData;
-
     // here the number of bits belonging together is being counted
     // which all have the color nBlackOrWhite (0xff oder 0x00)
     // from the position nBitPos on
-
-    nPos=nBitPos;
-    for (;;) {
-        if (nPos>=nDataSizeBits) {
+    sal_uInt16 nPos = nBitPos;
+    for (;;)
+    {
+        if (nPos>=nDataSizeBits)
+        {
             nPos=nDataSizeBits;
             break;
         }
-        nData=pData[nPos>>3];
-        nLo=nPos & 7;
-        if ( nLo==0 && nData==nBlackOrWhite) nPos+=8;
-        else {
-            if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) break;
-            nPos++;
+        sal_uInt8 nData = pData[nPos>>3];
+        sal_uInt16 nLo = nPos & 7;
+        if (nLo==0 && nData==nBlackOrWhite)
+        {
+            //fail on overflow attempt
+            if (nPos > SAL_MAX_UINT16-8)
+                return 0;
+            nPos+=8;
+        }
+        else
+        {
+            if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0)
+                break;
+            ++nPos;
         }
     }
-    if (nPos<=nBitPos) return 0;
-    else return nPos-nBitPos;
+    if (nPos<=nBitPos)
+        return 0;
+    return nPos-nBitPos;
 }
 
-
 void CCIDecompressor::Read1DScanlineData(sal_uInt8 * pTarget, sal_uInt16 nTargetBits)
 {
     sal_uInt16 nCode,nCodeBits,nDataBits,nTgtFreeByteBits;