[Libreoffice-commits] core.git: 2 commits - dbaccess/source filter/qa filter/source

Caolán McNamara caolanm at redhat.com
Mon Jul 20 04:31:05 PDT 2015


 dbaccess/source/ui/app/AppController.hxx     |    2 -
 dbaccess/source/ui/app/AppDetailView.hxx     |    2 -
 dbaccess/source/ui/app/AppIconControl.hxx    |    2 -
 filter/qa/cppunit/data/tiff/fail/hang-9.tiff |binary
 filter/source/graphicfilter/itiff/itiff.cxx  |   29 +++++++++++++++++----------
 5 files changed, 22 insertions(+), 13 deletions(-)

New commits:
commit 97a0e7558b24792827d77217fb2d8b1106056963
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 20 12:28:03 2015 +0100

    bail if offsets are past eof
    
    Change-Id: I4a8e78231befff498894ec92a1f38af206e13129

diff --git a/filter/qa/cppunit/data/tiff/fail/hang-9.tiff b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff
new file mode 100644
index 0000000..ef314ab
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 769c57e..180b1c3 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -57,6 +57,7 @@ private:
     BitmapWriteAccess*      pMaskAcc;
 
     sal_uLong               nOrigPos;                   // start position in pTIFF
+    sal_uLong               nEndOfFile;                 // end of file position in pTIFF
 
 
     sal_uInt16              nDataType;
@@ -131,6 +132,7 @@ public:
         , pAlphaMask(NULL)
         , pMaskAcc(NULL)
         , nOrigPos(0)
+        , nEndOfFile(0)
         , nDataType(0)
         , bByteSwap(false)
         , nNewSubFile(0)
@@ -540,7 +542,7 @@ bool TIFFReader::ReadMap()
 {
     if ( nCompression == 1 || nCompression == 32771 )
     {
-        sal_uLong np, nStrip, nStripBytesPerRow;
+        sal_uLong nStrip, nStripBytesPerRow;
 
         if ( nCompression == 1 )
             nStripBytesPerRow = nBytesPerRow;
@@ -548,7 +550,7 @@ bool TIFFReader::ReadMap()
             nStripBytesPerRow = ( nBytesPerRow + 1 ) & 0xfffffffe;
         for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
         {
-            for ( np = 0; np < nPlanes; np++ )
+            for (sal_uLong np = 0; np < nPlanes; ++np)
             {
                 nStrip = ny / GetRowsPerStrip() + np * nStripsPerPlane;
                 if ( nStrip >= nNumStripOffsets )
@@ -557,7 +559,7 @@ bool TIFFReader::ReadMap()
                 if (np >= SAL_N_ELEMENTS(pMap))
                     return false;
                 pTIFF->Read( pMap[ np ], nBytesPerRow );
-                if ( pTIFF->GetError() )
+                if (!pTIFF->good())
                     return false;
             }
             if ( !ConvertScanline( ny ) )
@@ -566,7 +568,7 @@ bool TIFFReader::ReadMap()
     }
     else if ( nCompression == 2 || nCompression == 3 || nCompression == 4 )
     {
-        sal_uLong np, nStrip, nOptions;
+        sal_uLong nStrip, nOptions;
         if ( nCompression == 2 )
         {
             nOptions = CCI_OPTION_BYTEALIGNROW;
@@ -595,6 +597,9 @@ bool TIFFReader::ReadMap()
         nStrip = 0;
         if ( nStrip >= nNumStripOffsets )
             return false;
+        sal_uLong nOffset = pStripOffsets[nStrip];
+        if (nOffset > nEndOfFile)
+            return false;
         pTIFF->Seek(pStripOffsets[nStrip]);
 
         CCIDecompressor aCCIDecom( nOptions, nImageWidth );
@@ -603,14 +608,17 @@ bool TIFFReader::ReadMap()
 
         for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
         {
-            for ( np = 0; np < nPlanes; np++ )
+            for (sal_uLong np = 0; np < nPlanes; np++ )
             {
                 if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
                 {
                     nStrip=ny/GetRowsPerStrip()+np*nStripsPerPlane;
                     if ( nStrip >= nNumStripOffsets )
                         return false;
-                    pTIFF->Seek( pStripOffsets[ nStrip ] );
+                    nOffset = pStripOffsets[nStrip];
+                    if (nOffset > nEndOfFile)
+                        return false;
+                    pTIFF->Seek(nOffset);
                     aCCIDecom.StartDecompression( *pTIFF );
                 }
                 if (np >= SAL_N_ELEMENTS(pMap))
@@ -627,7 +635,7 @@ bool TIFFReader::ReadMap()
     else if ( nCompression == 5 )
     {
         LZWDecompressor aLZWDecom;
-        sal_uLong np, nStrip;
+        sal_uLong nStrip;
         nStrip=0;
         if ( nStrip >= nNumStripOffsets )
             return false;
@@ -635,7 +643,7 @@ bool TIFFReader::ReadMap()
         aLZWDecom.StartDecompression(*pTIFF);
         for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
         {
-            for ( np = 0; np < nPlanes; np++ )
+            for (sal_uLong np = 0; np < nPlanes; ++np)
             {
                 if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
                 {
@@ -656,7 +664,7 @@ bool TIFFReader::ReadMap()
     }
     else if ( nCompression == 32773 )
     {
-        sal_uLong nStrip,nRecCount,np,i;
+        sal_uLong nStrip,nRecCount,i;
         sal_uInt8 * pdst;
         nStrip = 0;
         if ( nStrip >= nNumStripOffsets )
@@ -664,7 +672,7 @@ bool TIFFReader::ReadMap()
         pTIFF->Seek(pStripOffsets[nStrip]);
         for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
         {
-            for ( np = 0; np < nPlanes; np++ )
+            for (sal_uLong np = 0; np < nPlanes; ++np)
             {
                 if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip )
                 {
@@ -1178,6 +1186,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
 
     pTIFF = &rTIFF;
     nMaxPos = nOrigPos = pTIFF->Tell();
+    nEndOfFile = nOrigPos + pTIFF->remainingSize();
     // number format of pTIFF at the beginning
     SvStreamEndian nOrigNumberFormat = pTIFF->GetEndian();
 
commit a3cc2d8d598922b5dacd84721c05e73e435e999e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 20 12:28:53 2015 +0100

    cppcheck: noExplicitConstructor
    
    Change-Id: I6f25d8cf14e3e12eecb29eb02e018ecfa73539dd

diff --git a/dbaccess/source/ui/app/AppController.hxx b/dbaccess/source/ui/app/AppController.hxx
index b808254..7e4c664 100644
--- a/dbaccess/source/ui/app/AppController.hxx
+++ b/dbaccess/source/ui/app/AppController.hxx
@@ -415,7 +415,7 @@ namespace dbaui
         virtual ~OApplicationController();
 
     public:
-        OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB);
+        explicit OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB);
 
         DECLARE_XINTERFACE( )
         DECLARE_XTYPEPROVIDER( )
diff --git a/dbaccess/source/ui/app/AppDetailView.hxx b/dbaccess/source/ui/app/AppDetailView.hxx
index a429ff5..6405dc1 100644
--- a/dbaccess/source/ui/app/AppDetailView.hxx
+++ b/dbaccess/source/ui/app/AppDetailView.hxx
@@ -55,7 +55,7 @@ namespace dbaui
         vcl::Font               m_aOriginalFont;
 
     public:
-        OCreationList( OTasksWindow& _rParent );
+        explicit OCreationList( OTasksWindow& _rParent );
         // Window overrides
         virtual void MouseMove( const MouseEvent& rMEvt ) SAL_OVERRIDE;
         virtual void MouseButtonDown( const MouseEvent& rMEvt ) SAL_OVERRIDE;
diff --git a/dbaccess/source/ui/app/AppIconControl.hxx b/dbaccess/source/ui/app/AppIconControl.hxx
index 10c425b..54a9c1a 100644
--- a/dbaccess/source/ui/app/AppIconControl.hxx
+++ b/dbaccess/source/ui/app/AppIconControl.hxx
@@ -32,7 +32,7 @@ namespace dbaui
         IControlActionListener*     m_pActionListener;
 
     public:
-        OApplicationIconControl(vcl::Window* _pParent);
+        explicit OApplicationIconControl(vcl::Window* _pParent);
         virtual ~OApplicationIconControl();
         virtual void dispose() SAL_OVERRIDE;
 


More information about the Libreoffice-commits mailing list