[Libreoffice-commits] core.git: 3 commits - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

New commits:
commit ee619fb344c7e8f491e09bd256df7f8567af9bef
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 23 11:05:40 2017 +0000

    ofz: don't read data that isn't there
    
    Change-Id: I7fdcb78bde8f650c1a57d34177d8993a6d8a0a2f

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 12aee89..807756a 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -995,6 +995,12 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                 {
                     sal_uInt32 nByteCount = nImageWidth >> 3;
 
+                    sal_uInt32 nBytesNeeded = nByteCount;
+                    if (nImageWidth & 7)
+                        ++nBytesNeeded;
+                    if (pt + nBytesNeeded > ptend)
+                        return false;
+
                     if ( bByteSwap )
                     {
                         sal_Int32 nx = 0;
commit 46b1b5dd2a5368663fd56434160fa126f1a54d84
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 23 11:03:49 2017 +0000

    make this a little clearer
    
    no logic change intended
    
    Change-Id: Ibfc46d0aba9e220be54270734e0cdfbc123be9a5

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 4fdbb30..12aee89 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -993,12 +993,12 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 
                 case 1 :
                 {
-                    sal_uInt32 nByteCount = ( nImageWidth >> 3 ) + 1;
+                    sal_uInt32 nByteCount = nImageWidth >> 3;
 
                     if ( bByteSwap )
                     {
                         sal_Int32 nx = 0;
-                        while ( --nByteCount )
+                        while (nByteCount--)
                         {
                             nByteVal = *pt++;
                             pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
@@ -1030,7 +1030,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                     else
                     {
                         sal_Int32 nx = 7;
-                        while ( --nByteCount )
+                        while (nByteCount--)
                         {
                             nByteVal = *pt++;
                             pAcc->SetPixelIndex( nY, nx, nByteVal & 1 );
commit 840ad0a88045021c58644404a099a3678a371020
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 23 11:01:00 2017 +0000

    improve scoping
    
    Change-Id: Ic79d46da4e322a0f52981c3a3df65f7f0294fdd8

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 6101d20..4fdbb30 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -782,7 +782,7 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, sal_uLong nBitsPos, sal_u
 
 bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
-    sal_uInt32  nRed, nGreen, nBlue, ns, nVal, nByteCount;
+    sal_uInt32  nRed, nGreen, nBlue, ns, nVal;
     sal_uInt8   nByteVal;
 
     if ( nDstBitsPerPixel == 24 )
@@ -993,10 +993,11 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 
                 case 1 :
                 {
+                    sal_uInt32 nByteCount = ( nImageWidth >> 3 ) + 1;
+
                     if ( bByteSwap )
                     {
                         sal_Int32 nx = 0;
-                        nByteCount = ( nImageWidth >> 3 ) + 1;
                         while ( --nByteCount )
                         {
                             nByteVal = *pt++;
@@ -1029,7 +1030,6 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                     else
                     {
                         sal_Int32 nx = 7;
-                        nByteCount = ( nImageWidth >> 3 ) + 1;
                         while ( --nByteCount )
                         {
                             nByteVal = *pt++;