[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/itiff/itiff.cxx |   19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

New commits:
commit 663702cd3e8dc6967d8a6762ae534e06dc7d502b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Feb 26 10:11:57 2018 +0000

    ofz#6561 sanitize palette index
    
    Change-Id: I78cc6a7eab114fdbcc438385706d56cd48a4f1fc
    Reviewed-on: https://gerrit.libreoffice.org/50351
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index e19d6b2d5f9c..5fa3ae7eb796 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1205,6 +1205,23 @@ bool TIFFReader::HasAlphaChannel() const
            );
 }
 
+namespace
+{
+    Color SanitizePaletteIndex(sal_uInt8 nIndex, const std::vector<Color>& rPalette)
+    {
+        const size_t nPaletteEntryCount = rPalette.size();
+        if (nPaletteEntryCount && nIndex >= nPaletteEntryCount)
+        {
+            auto nSanitizedIndex = nIndex % nPaletteEntryCount;
+            SAL_WARN_IF(nIndex != nSanitizedIndex, "vcl", "invalid colormap index: "
+                        << static_cast<unsigned int>(nIndex) << ", colormap len is: "
+                        << nPaletteEntryCount);
+            nIndex = nSanitizedIndex;
+        }
+
+        return rPalette[nIndex];
+    }
+}
 
 bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
 {
@@ -1548,7 +1565,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
                             for (sal_Int32 nX = 0; nX < nImageWidth; ++nX)
                             {
                                 auto p = maBitmap.data() + ((maBitmapPixelSize.Width() * nY + nX) * 3);
-                                auto c = mvPalette[*p];
+                                auto c = SanitizePaletteIndex(*p, mvPalette);
                                 *p = c.GetRed();
                                 p++;
                                 *p = c.GetGreen();