[Libreoffice-commits] core.git: 2 commits - dbaccess/source filter/qa filter/source
Caolán McNamara
caolanm at redhat.com
Mon Jul 20 04:31:05 PDT 2015
dbaccess/source/ui/app/AppController.hxx | 2 -
dbaccess/source/ui/app/AppDetailView.hxx | 2 -
dbaccess/source/ui/app/AppIconControl.hxx | 2 -
filter/qa/cppunit/data/tiff/fail/hang-9.tiff |binary
filter/source/graphicfilter/itiff/itiff.cxx | 29 +++++++++++++++++----------
5 files changed, 22 insertions(+), 13 deletions(-)
New commits:
commit 97a0e7558b24792827d77217fb2d8b1106056963
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Jul 20 12:28:03 2015 +0100
bail if offsets are past eof
Change-Id: I4a8e78231befff498894ec92a1f38af206e13129
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-9.tiff b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff
new file mode 100644
index 0000000..ef314ab
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 769c57e..180b1c3 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -57,6 +57,7 @@ private:
BitmapWriteAccess* pMaskAcc;
sal_uLong nOrigPos; // start position in pTIFF
+ sal_uLong nEndOfFile; // end of file position in pTIFF
sal_uInt16 nDataType;
@@ -131,6 +132,7 @@ public:
, pAlphaMask(NULL)
, pMaskAcc(NULL)
, nOrigPos(0)
+ , nEndOfFile(0)
, nDataType(0)
, bByteSwap(false)
, nNewSubFile(0)
@@ -540,7 +542,7 @@ bool TIFFReader::ReadMap()
{
if ( nCompression == 1 || nCompression == 32771 )
{
- sal_uLong np, nStrip, nStripBytesPerRow;
+ sal_uLong nStrip, nStripBytesPerRow;
if ( nCompression == 1 )
nStripBytesPerRow = nBytesPerRow;
@@ -548,7 +550,7 @@ bool TIFFReader::ReadMap()
nStripBytesPerRow = ( nBytesPerRow + 1 ) & 0xfffffffe;
for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
{
- for ( np = 0; np < nPlanes; np++ )
+ for (sal_uLong np = 0; np < nPlanes; ++np)
{
nStrip = ny / GetRowsPerStrip() + np * nStripsPerPlane;
if ( nStrip >= nNumStripOffsets )
@@ -557,7 +559,7 @@ bool TIFFReader::ReadMap()
if (np >= SAL_N_ELEMENTS(pMap))
return false;
pTIFF->Read( pMap[ np ], nBytesPerRow );
- if ( pTIFF->GetError() )
+ if (!pTIFF->good())
return false;
}
if ( !ConvertScanline( ny ) )
@@ -566,7 +568,7 @@ bool TIFFReader::ReadMap()
}
else if ( nCompression == 2 || nCompression == 3 || nCompression == 4 )
{
- sal_uLong np, nStrip, nOptions;
+ sal_uLong nStrip, nOptions;
if ( nCompression == 2 )
{
nOptions = CCI_OPTION_BYTEALIGNROW;
@@ -595,6 +597,9 @@ bool TIFFReader::ReadMap()
nStrip = 0;
if ( nStrip >= nNumStripOffsets )
return false;
+ sal_uLong nOffset = pStripOffsets[nStrip];
+ if (nOffset > nEndOfFile)
+ return false;
pTIFF->Seek(pStripOffsets[nStrip]);
CCIDecompressor aCCIDecom( nOptions, nImageWidth );
@@ -603,14 +608,17 @@ bool TIFFReader::ReadMap()
for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
{
- for ( np = 0; np < nPlanes; np++ )
+ for (sal_uLong np = 0; np < nPlanes; np++ )
{
if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
{
nStrip=ny/GetRowsPerStrip()+np*nStripsPerPlane;
if ( nStrip >= nNumStripOffsets )
return false;
- pTIFF->Seek( pStripOffsets[ nStrip ] );
+ nOffset = pStripOffsets[nStrip];
+ if (nOffset > nEndOfFile)
+ return false;
+ pTIFF->Seek(nOffset);
aCCIDecom.StartDecompression( *pTIFF );
}
if (np >= SAL_N_ELEMENTS(pMap))
@@ -627,7 +635,7 @@ bool TIFFReader::ReadMap()
else if ( nCompression == 5 )
{
LZWDecompressor aLZWDecom;
- sal_uLong np, nStrip;
+ sal_uLong nStrip;
nStrip=0;
if ( nStrip >= nNumStripOffsets )
return false;
@@ -635,7 +643,7 @@ bool TIFFReader::ReadMap()
aLZWDecom.StartDecompression(*pTIFF);
for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
{
- for ( np = 0; np < nPlanes; np++ )
+ for (sal_uLong np = 0; np < nPlanes; ++np)
{
if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
{
@@ -656,7 +664,7 @@ bool TIFFReader::ReadMap()
}
else if ( nCompression == 32773 )
{
- sal_uLong nStrip,nRecCount,np,i;
+ sal_uLong nStrip,nRecCount,i;
sal_uInt8 * pdst;
nStrip = 0;
if ( nStrip >= nNumStripOffsets )
@@ -664,7 +672,7 @@ bool TIFFReader::ReadMap()
pTIFF->Seek(pStripOffsets[nStrip]);
for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
{
- for ( np = 0; np < nPlanes; np++ )
+ for (sal_uLong np = 0; np < nPlanes; ++np)
{
if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
{
@@ -1178,6 +1186,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
pTIFF = &rTIFF;
nMaxPos = nOrigPos = pTIFF->Tell();
+ nEndOfFile = nOrigPos + pTIFF->remainingSize();
// number format of pTIFF at the beginning
SvStreamEndian nOrigNumberFormat = pTIFF->GetEndian();
commit a3cc2d8d598922b5dacd84721c05e73e435e999e
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Jul 20 12:28:53 2015 +0100
cppcheck: noExplicitConstructor
Change-Id: I6f25d8cf14e3e12eecb29eb02e018ecfa73539dd
diff --git a/dbaccess/source/ui/app/AppController.hxx b/dbaccess/source/ui/app/AppController.hxx
index b808254..7e4c664 100644
--- a/dbaccess/source/ui/app/AppController.hxx
+++ b/dbaccess/source/ui/app/AppController.hxx
@@ -415,7 +415,7 @@ namespace dbaui
virtual ~OApplicationController();
public:
- OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB);
+ explicit OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB);
DECLARE_XINTERFACE( )
DECLARE_XTYPEPROVIDER( )
diff --git a/dbaccess/source/ui/app/AppDetailView.hxx b/dbaccess/source/ui/app/AppDetailView.hxx
index a429ff5..6405dc1 100644
--- a/dbaccess/source/ui/app/AppDetailView.hxx
+++ b/dbaccess/source/ui/app/AppDetailView.hxx
@@ -55,7 +55,7 @@ namespace dbaui
vcl::Font m_aOriginalFont;
public:
- OCreationList( OTasksWindow& _rParent );
+ explicit OCreationList( OTasksWindow& _rParent );
// Window overrides
virtual void MouseMove( const MouseEvent& rMEvt ) SAL_OVERRIDE;
virtual void MouseButtonDown( const MouseEvent& rMEvt ) SAL_OVERRIDE;
diff --git a/dbaccess/source/ui/app/AppIconControl.hxx b/dbaccess/source/ui/app/AppIconControl.hxx
index 10c425b..54a9c1a 100644
--- a/dbaccess/source/ui/app/AppIconControl.hxx
+++ b/dbaccess/source/ui/app/AppIconControl.hxx
@@ -32,7 +32,7 @@ namespace dbaui
IControlActionListener* m_pActionListener;
public:
- OApplicationIconControl(vcl::Window* _pParent);
+ explicit OApplicationIconControl(vcl::Window* _pParent);
virtual ~OApplicationIconControl();
virtual void dispose() SAL_OVERRIDE;
More information about the Libreoffice-commits
mailing list