[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

New commits:
commit 1cde1dd46b04321721fc9f474acec706ccc7961b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 15 14:06:41 2018 +0000

    ofz#6345 Integer-overflow
    
    Change-Id: I537b49bac053c0f55bbbc26b0d37dfae4c62106a
    Reviewed-on: https://gerrit.libreoffice.org/49817
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 24b6c7143863..83285b922cf7 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1520,10 +1520,21 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
                 }
             }
 
+            sal_Int32 nImageDataSize(0);
+            if (bStatus)
+            {
+                if (o3tl::checked_multiply<sal_Int32>(nImageWidth, nImageLength, nImageDataSize) ||
+                    o3tl::checked_multiply<sal_Int32>(nImageDataSize, (HasAlphaChannel() ? 4 : 3), nImageDataSize) ||
+                    nImageDataSize > SAL_MAX_INT32/2)
+                {
+                    bStatus = false;
+                }
+            }
+
             if ( bStatus )
             {
                 maBitmapPixelSize = Size(nImageWidth, nImageLength);
-                mpBitmap.reset(new sal_uInt8[nImageWidth * nImageLength * (HasAlphaChannel() ? 4 : 3)]);
+                mpBitmap.reset(new sal_uInt8[nImageDataSize]);
 
                 if (bStatus && ReadMap())
                 {