[Libreoffice-commits] core.git: filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/itiff/itiff.cxx |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit 49d17d392b7c7a309b3d9264643881656d386eb1
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Jul 21 19:55:29 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sun Jul 21 22:32:46 2019 +0200

    ofz#15993 Timeout
    
    massive nSamplesPerPixel value, tiff spec says samples-per-pixel is
    supposed to be SHORT so don't accept beyond that as legal
    
    Change-Id: I3e6d3550e3b07a8d27ec4d72ecc4549dd52e50bc
    Reviewed-on: https://gerrit.libreoffice.org/76075
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 970e5958635f..15a4fe3d3b43 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -427,6 +427,10 @@ void TIFFReader::ReadTagData( sal_uInt16 nTagType, sal_uInt32 nDataLen)
         case 0x0115:   // Samples Per Pixel
             nSamplesPerPixel = ReadIntData();
             SAL_INFO("filter.tiff","SamplesPerPixel: " << nSamplesPerPixel);
+
+            if (nSamplesPerPixel > USHRT_MAX) // ofz#15993 the expected type is SHORT
+                bStatus = false;
+
             break;
 
         case 0x0116:   // Rows Per Strip