[Libreoffice-commits] core.git: filter/source

[Caolán McNamara (via logerrit)]

 filter/source/graphicfilter/itiff/ccidecom.cxx |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

New commits:
commit a9665403cd997c1c593efc52682a87ffb3c1e87a
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Dec 2 09:26:54 2020 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Dec 2 16:45:43 2020 +0100

    ofz#27839 Timeout
    
    use sal_uInt32 and truncate to limit instead of using sal_uInt16
    
    Change-Id: I454fcf23ff272069f8e4499b1ce9674cfb8e4564
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107068
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx
index 9c9b916a1d8c..407aab17d669 100644
--- a/filter/source/graphicfilter/itiff/ccidecom.cxx
+++ b/filter/source/graphicfilter/itiff/ccidecom.cxx
@@ -871,12 +871,12 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits,
 }
 
 sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits,
-                                  sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite)
+                                      sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite)
 {
     // here the number of bits belonging together is being counted
     // which all have the color nBlackOrWhite (0xff or 0x00)
     // from the position nBitPos on
-    sal_uInt16 nPos = nBitPos;
+    sal_uInt32 nPos = nBitPos;
     for (;;)
     {
         if (nPos>=nDataSizeBits)
@@ -888,9 +888,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataS
         sal_uInt16 nLo = nPos & 7;
         if (nLo==0 && nData==nBlackOrWhite)
         {
-            //fail on overflow attempt
-            if (nPos > SAL_MAX_UINT16-8)
-                return 0;
             nPos+=8;
         }
         else
@@ -900,8 +897,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataS
             ++nPos;
         }
     }
-    if (nPos<=nBitPos)
-        return 0;
     return nPos-nBitPos;
 }