[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

New commits:
commit 4e1161c6cbdaf2bf0a92d3a5195ee559f2b77bed
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 14 12:23:19 2018 +0000

    ofz#6315 Heap-buffer-overflow
    
    Change-Id: Ia611f65b9fb38f125c224473e584580eeff20622
    Reviewed-on: https://gerrit.libreoffice.org/49716
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index d86d2912804d..24b6c7143863 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -584,6 +584,7 @@ bool TIFFReader::ReadMap()
 
         aCCIDecom.StartDecompression( *pTIFF );
 
+        const bool bHasAlphaChannel = HasAlphaChannel();
         for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
         {
             bool bDifferentToPrev = ny == 0;
@@ -617,9 +618,10 @@ bool TIFFReader::ReadMap()
                 //if the buffer for this line didn't change, then just copy the
                 //previous scanline instead of painfully decoding and setting
                 //each pixel one by one again
-                memcpy( mpBitmap.get() + (ny * maBitmapPixelSize.Width()) * 4,
-                        mpBitmap.get() + ((ny-1) * maBitmapPixelSize.Width()) * 4,
-                        maBitmapPixelSize.Width() * 4);
+                const int nColorSize = bHasAlphaChannel ? 4 : 3;
+                memcpy( mpBitmap.get() + (ny * maBitmapPixelSize.Width()) * nColorSize,
+                        mpBitmap.get() + ((ny-1) * maBitmapPixelSize.Width()) * nColorSize,
+                        maBitmapPixelSize.Width() * nColorSize);
             }
             else
             {