[Libreoffice-commits] core.git: Branch 'libreoffice-6-2' - vcl/qa vcl/source

[Libreoffice Gerrit user]

 vcl/source/gdi/dibtools.cxx |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

New commits:
commit b0583892ed754ffc7957e32e9c6cda3317a7a4b0
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jan 30 13:36:01 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jan 31 12:24:54 2019 +0100

    Resolves: tdf#122958 bmps with weird compression values that work in mso
    
    Change-Id: Ie1887288cba7c1d56b807dbc9ddb886b9d20ff33
    Reviewed-on: https://gerrit.libreoffice.org/67144
    Tested-by: Jenkins
    Tested-by: Xisco Faulí <xiscofauli at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf
similarity index 100%
rename from vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf
rename to vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index b6ffa8fd9908..b06e05527499 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -935,6 +935,18 @@ bool ImplReadDIBBody(SvStream& rIStm, Bitmap& rBmp, AlphaMask* pBmpAlpha, sal_uL
         }
         case BITFIELDS:
             break;
+        default:
+            // tdf#122958 invalid compression value used
+            if (aHeader.nCompression & 0x000F)
+            {
+                // lets assume that there was an error in the generating application
+                // and allow through as COMPRESS_NONE if the bottom byte is 0
+                SAL_WARN( "vcl", "bad bmp compression scheme: " << aHeader.nCompression << ", rejecting bmp");
+                return false;
+            }
+            else
+                SAL_WARN( "vcl", "bad bmp compression scheme: " << aHeader.nCompression << ", assuming meant to be COMPRESS_NONE");
+            SAL_FALLTHROUGH;
         case ZCOMPRESS:
         case COMPRESS_NONE:
         {
@@ -945,8 +957,6 @@ bool ImplReadDIBBody(SvStream& rIStm, Bitmap& rBmp, AlphaMask* pBmpAlpha, sal_uL
                 return false;
             break;
         }
-        default:
-            return false;
     }
 
     const Size aSizePixel(aHeader.nWidth, aHeader.nHeight);