[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/ccidecom.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 138737f26407acfd6cf431e4a8745569fb786dec
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 28 16:43:44 2017 +0000

    ofz#668: check nTargetBits size
    
    Change-Id: I5cc7499cfdee58ffa480bb31dfc262d5b781180d
    (cherry picked from commit 99c361be16eb3a21aa679a103db2d07ecd0f5d3c)
    Reviewed-on: https://gerrit.libreoffice.org/34723
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx
index 1cb7d7d..4fcb6b9 100644
--- a/filter/source/graphicfilter/itiff/ccidecom.cxx
+++ b/filter/source/graphicfilter/itiff/ccidecom.cxx
@@ -627,7 +627,9 @@ void CCIDecompressor::StartDecompression( SvStream & rIStream )
 
 bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTargetBits, bool bLastLine )
 {
-    bool b2D;
+    //Read[1|2]DScanlineData take a sal_uInt16, so its either limit here or expand there
+    if (nTargetBits > SAL_MAX_UINT16)
+        return false;
 
     if ( nEOLCount >= 5 )   // RTC (Return To Controller)
         return true;
@@ -682,6 +684,7 @@ bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTarget
     if ( nOptions & CCI_OPTION_BYTEALIGNROW )
         nInputBitsBufSize &= 0xfff8;
 
+    bool b2D;
     // is it a 2D row?
     if ( nOptions & CCI_OPTION_2D )
     {