[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |   23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

New commits:
commit 8b053a3c88c2b3e203856dbd9dabca6c935b0bde
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Sep 30 21:22:27 2017 +0100

    ofz#3532 avoid oom
    
    Change-Id: Ic046ebcb4c312716997eba9c18079db59c0b41f6
    Reviewed-on: https://gerrit.libreoffice.org/42974
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index ecda46305201..e9f07689387c 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1434,6 +1434,29 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
                             bStatus = false;
                     }
                 }
+                else if ( nCompression == 5 )
+                {
+                    sal_uInt32 np = nPlanes - 1;
+                    if (np >= SAL_N_ELEMENTS(aMap))
+                        bStatus = false;
+                    sal_Int32 ny = nImageLength - 1;
+                    sal_uInt32 nStrip(0);
+                    nDiv = GetRowsPerStrip();
+                    if (bStatus)
+                        bStatus = nDiv != 0;
+                    if (bStatus)
+                    {
+                        nStrip = ny / nDiv + np * nStripsPerPlane;
+                        if (nStrip >= aStripOffsets.size())
+                            bStatus = false;
+                    }
+                    if (bStatus)
+                    {
+                        auto nStart = aStripOffsets[nStrip];
+                        if (nStart > nEndOfFile)
+                            bStatus = false;
+                    }
+                }
             }
 
             if ( bStatus )