[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/hang-8.tiff |binary
 filter/source/graphicfilter/itiff/itiff.cxx  |    6 ++++--
 2 files changed, 4 insertions(+), 2 deletions(-)

New commits:
commit f8b78fb646dbea25fe1aff05e71b7c4cb2410552
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 20 11:40:34 2015 +0100

    fail on short read
    
    Change-Id: I7215cf8d8b1e4a4156c87507018de3c2b7ed08d8
    (cherry picked from commit 8eaef6b5217eecaa111c80e426bdf225481a71fb)
    Reviewed-on: https://gerrit.libreoffice.org/17219
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/qa/cppunit/data/tiff/fail/hang-8.tiff b/filter/qa/cppunit/data/tiff/fail/hang-8.tiff
new file mode 100644
index 0000000..c458597
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-8.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index f0c5d1e..769c57e 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -656,7 +656,7 @@ bool TIFFReader::ReadMap()
     }
     else if ( nCompression == 32773 )
     {
-        sal_uLong nStrip,nRecCount,nRowBytesLeft,np,i;
+        sal_uLong nStrip,nRecCount,np,i;
         sal_uInt8 * pdst;
         nStrip = 0;
         if ( nStrip >= nNumStripOffsets )
@@ -673,7 +673,7 @@ bool TIFFReader::ReadMap()
                         return false;
                     pTIFF->Seek(pStripOffsets[nStrip]);
                 }
-                nRowBytesLeft = nBytesPerRow;
+                sal_uLong nRowBytesLeft = nBytesPerRow;
                 if (np >= SAL_N_ELEMENTS(pMap))
                     return false;
                 pdst=pMap[ np ];
@@ -687,6 +687,8 @@ bool TIFFReader::ReadMap()
                         if ( nRecCount > nRowBytesLeft )
                             return false;
                         pTIFF->Read(pdst,nRecCount);
+                        if (!pTIFF->good())
+                            return false;
                         pdst+=nRecCount;
                         nRowBytesLeft-=nRecCount;
                     }