[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/gdi/pngread.cxx |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

New commits:
commit 0f0f02d633e2f9e69220d3d47de17b9e34b00765
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 8 14:23:27 2017 +0000

    ofz#574 sanitize png palette indexes
    
    Change-Id: I006ffdf5c8c751e7e07b133716022e2a9b154478
    Reviewed-on: https://gerrit.libreoffice.org/34034
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index bea6e07..6cf9828 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -1114,6 +1114,19 @@ void PNGReaderImpl::ImplApplyFilter()
 
 namespace
 {
+    sal_uInt8 SanitizePaletteIndex(sal_uInt8 nIndex, sal_uInt16 nPaletteEntryCount)
+    {
+        if (nIndex >= nPaletteEntryCount)
+        {
+            auto nSanitizedIndex = nIndex % nPaletteEntryCount;
+            SAL_WARN_IF(nIndex != nSanitizedIndex, "vcl", "invalid colormap index: "
+                        << static_cast<unsigned int>(nIndex) << ", colormap len is: "
+                        << nPaletteEntryCount);
+            nIndex = nSanitizedIndex;
+        }
+        return nIndex;
+    }
+
     void SanitizePaletteIndexes(sal_uInt8* pEntries, int nLen, const Bitmap::ScopedWriteAccess& rAcc)
     {
         sal_uInt16 nPaletteEntryCount = rAcc->GetPaletteEntryCount();
@@ -1602,7 +1615,7 @@ void PNGReaderImpl::ImplSetPixel( sal_uInt32 nY, sal_uInt32 nX, sal_uInt8 nPalIn
         return;
     nX >>= mnPreviewShift;
 
-    mxAcc->SetPixelIndex( nY, nX, nPalIndex );
+    mxAcc->SetPixelIndex(nY, nX, SanitizePaletteIndex(nPalIndex, mxAcc->GetPaletteEntryCount()));
 }
 
 void PNGReaderImpl::ImplSetTranspPixel( sal_uInt32 nY, sal_uInt32 nX, const BitmapColor& rBitmapColor, bool bTrans )
@@ -1628,7 +1641,7 @@ void PNGReaderImpl::ImplSetAlphaPixel( sal_uInt32 nY, sal_uInt32 nX,
         return;
     nX >>= mnPreviewShift;
 
-    mxAcc->SetPixelIndex( nY, nX, nPalIndex );
+    mxAcc->SetPixelIndex(nY, nX, SanitizePaletteIndex(nPalIndex, mxAcc->GetPaletteEntryCount()));
     mpMaskAcc->SetPixel(nY, nX, BitmapColor(~nAlpha));
 }