[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - vcl/qa vcl/source

[Libreoffice Gerrit user]

 vcl/source/gdi/dibtools.cxx |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

New commits:
commit a7815e365bdb5544a0a9c63c6d730cf591f286d7
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jan 30 13:36:01 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jan 31 12:25:08 2019 +0100

    Resolves: tdf#122958 bmps with weird compression values that work in mso
    
    Change-Id: Ie1887288cba7c1d56b807dbc9ddb886b9d20ff33
    Reviewed-on: https://gerrit.libreoffice.org/67145
    Tested-by: Jenkins
    Tested-by: Xisco Faulí <xiscofauli at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf
similarity index 100%
rename from vcl/qa/cppunit/graphicfilter/data/wmf/fail/CVE-2015-0848-1.wmf
rename to vcl/qa/cppunit/graphicfilter/data/wmf/pass/CVE-2015-0848-1.wmf
diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index de8615226492..4088d6287894 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -939,6 +939,18 @@ bool ImplReadDIBBody(SvStream& rIStm, Bitmap& rBmp, AlphaMask* pBmpAlpha, sal_uL
         }
         case BITFIELDS:
             break;
+        default:
+            // tdf#122958 invalid compression value used
+            if (aHeader.nCompression & 0x000F)
+            {
+                // lets assume that there was an error in the generating application
+                // and allow through as COMPRESS_NONE if the bottom byte is 0
+                SAL_WARN( "vcl", "bad bmp compression scheme: " << aHeader.nCompression << ", rejecting bmp");
+                return false;
+            }
+            else
+                SAL_WARN( "vcl", "bad bmp compression scheme: " << aHeader.nCompression << ", assuming meant to be COMPRESS_NONE");
+            SAL_FALLTHROUGH;
         case ZCOMPRESS:
         case COMPRESS_NONE:
         {
@@ -950,8 +962,6 @@ bool ImplReadDIBBody(SvStream& rIStm, Bitmap& rBmp, AlphaMask* pBmpAlpha, sal_uL
                 return false;
             break;
         }
-        default:
-            return false;
     }
 
     const Size aSizePixel(aHeader.nWidth, aHeader.nHeight);