[Libreoffice-commits] core.git: vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif |binary
 vcl/source/filter/igif/gifread.cxx                         |   13 ++++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit 4091841023c745edcd696af06a872c1affd6e36d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 31 10:49:01 2017 +0100

    ofz#3240: avoid oom in gif loader
    
    Change-Id: Ifd00962ed607166b5521a3977a3021fb7b24957e
    Reviewed-on: https://gerrit.libreoffice.org/41747
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif b/vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif
new file mode 100644
index 000000000000..26b35e63b2eb
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif differ
diff --git a/vcl/source/filter/igif/gifread.cxx b/vcl/source/filter/igif/gifread.cxx
index ef2cb32ed7fe..9d07b805417d 100644
--- a/vcl/source/filter/igif/gifread.cxx
+++ b/vcl/source/filter/igif/gifread.cxx
@@ -175,12 +175,19 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal,
     // so assume compression of 1:2560 is possible
     // (http://cloudinary.com/blog/a_one_color_image_is_worth_two_thousand_words suggests
     // 1:1472.88 [184.11 x 8] is more realistic)
-    const sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
+
+    sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
+    for (size_t i = 0; i < aAnimation.Count(); ++i)
+    {
+        const Size& rSize = aAnimation.Get(i).aSizePix;
+        nMinFileData += rSize.Width() * rSize.Height() / 2560;
+    }
+
     if (nMaxStreamData < nMinFileData)
     {
         //there is nowhere near enough data in this stream to fill the claimed dimensions
-        SAL_WARN("vcl.filter", "gif claims dimensions " << nWidth << " x " << nHeight <<
-                               " but filesize of " << nMaxStreamData << " is surely insufficiently large to fill it");
+        SAL_WARN("vcl.filter", "in gif frame index " << aAnimation.Count() << " gif claims dimensions " << nWidth << " x " << nHeight <<
+                               " but filesize of " << nMaxStreamData << " is surely insufficiently large to fill all frame images");
         bStatus = false;
         return;
     }