[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit 2166fd06156c8f31948e755b5893911d93fcb6a2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 22 20:39:13 2017 +0000

    ofz: don't read data that isn't there
    
    Change-Id: I9f730c321755cde169d940b49fc93bbe057ead57
    (cherry picked from commit c5b1a01ddfa54156b4fa8e542d6936908257ca93)

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index d7a26ea..0ef0081 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -929,12 +929,16 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
         {
             sal_uLong nMinMax = ( ( 1 << nDstBitsPerPixel ) - 1 ) / ( nMaxSampleValue - nMinSampleValue );
             sal_uInt8* pt = pMap[ 0 ];
+            sal_uInt8* ptend = pt + nBytesPerRow;
             sal_uInt8 nShift;
 
             switch ( nDstBitsPerPixel )
             {
                 case 8 :
                 {
+                    if (pt + nImageWidth > ptend)
+                        return false;
+
                     if ( bByteSwap )
                     {
                         if ( nPredictor == 2 )