[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - filter/qa filter/source

[Caolán McNamara]

 filter/qa/cppunit/data/tiff/fail/crash-7.tiff |binary
 filter/source/graphicfilter/itiff/itiff.cxx   |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit c7fb0ab137dbe385f54030c7420cbd1007e9f005
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jul 21 10:10:50 2015 +0100

    reject invalid tiff dimensions
    
    Change-Id: I64e77f12cb016a7f4a9d21c732aaeaae7959da76
    (cherry picked from commit 34d062147c16090fa42c27ac7960e3f5e3b65d2b)
    Reviewed-on: https://gerrit.libreoffice.org/17258
    Reviewed-by: Adolfo Jayme Barrientos <fitojb at ubuntu.com>
    Tested-by: Adolfo Jayme Barrientos <fitojb at ubuntu.com>

diff --git a/filter/qa/cppunit/data/tiff/fail/crash-7.tiff b/filter/qa/cppunit/data/tiff/fail/crash-7.tiff
new file mode 100644
index 0000000..0056f9d
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-7.tiff differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index c7dc759..2ac8ac8 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1337,6 +1337,8 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
             }
             if ( !nBitsPerSample || ( nBitsPerSample > 32 ) )
                 bStatus = false;
+            if (nImageWidth < 0 || nImageLength < 0)
+                bStatus = false;
             if ( bStatus )
             {
                 if ( nMaxSampleValue == 0 )