[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

New commits:
commit 4c9383e1354be0954c5f7cf8906f334ae079baeb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 23 11:01:00 2017 +0000

    ofz: don't read data that isn't there
    
    Change-Id: I7fdcb78bde8f650c1a57d34177d8993a6d8a0a2f
    (cherry picked from commit ee619fb344c7e8f491e09bd256df7f8567af9bef)
    
    improve scoping
    
    Change-Id: Ic79d46da4e322a0f52981c3a3df65f7f0294fdd8
    (cherry picked from commit 840ad0a88045021c58644404a099a3678a371020)
    
    make this a little clearer
    
    no logic change intended
    
    Change-Id: Ibfc46d0aba9e220be54270734e0cdfbc123be9a5
    (cherry picked from commit 46b1b5dd2a5368663fd56434160fa126f1a54d84)
    Reviewed-on: https://gerrit.libreoffice.org/34573
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index c5438d1..f744baf 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -788,7 +788,7 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, sal_uLong nBitsPos, sal_u
 
 bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
-    sal_uInt32  nRed, nGreen, nBlue, ns, nVal, nByteCount;
+    sal_uInt32  nRed, nGreen, nBlue, ns, nVal;
     sal_uInt8   nByteVal;
 
     if ( nDstBitsPerPixel == 24 )
@@ -999,11 +999,18 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 
                 case 1 :
                 {
+                    sal_uInt32 nByteCount = nImageWidth >> 3;
+
+                    sal_uInt32 nBytesNeeded = nByteCount;
+                    if (nImageWidth & 7)
+                        ++nBytesNeeded;
+                    if (pt + nBytesNeeded > ptend)
+                        return false;
+
                     if ( bByteSwap )
                     {
                         sal_Int32 nx = 0;
-                        nByteCount = ( nImageWidth >> 3 ) + 1;
-                        while ( --nByteCount )
+                        while (nByteCount--)
                         {
                             nByteVal = *pt++;
                             pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
@@ -1035,8 +1042,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                     else
                     {
                         sal_Int32 nx = 7;
-                        nByteCount = ( nImageWidth >> 3 ) + 1;
-                        while ( --nByteCount )
+                        while (nByteCount--)
                         {
                             nByteVal = *pt++;
                             pAcc->SetPixelIndex( nY, nx, nByteVal & 1 );