[Libreoffice-commits] core.git: vcl/qa vcl/source

[Caolán McNamara (via logerrit)]

 vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png |binary
 vcl/source/filter/png/PngImageReader.cxx                |   21 +++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

New commits:
commit 76546f678e86b5c551f3dfe28f35864cebdd2019
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Mar 13 19:51:14 2021 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sun Mar 14 22:01:54 2021 +0100

    ofz#32026 null-deref
    
    Change-Id: I9bb0e75a91c3646b86be24954249c319b63f6a2a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112462
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png b/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png
new file mode 100644
index 000000000000..290671ecb43d
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/png/fail/ofz32026.png differ
diff --git a/vcl/source/filter/png/PngImageReader.cxx b/vcl/source/filter/png/PngImageReader.cxx
index b1e8e10cdc1d..32231de9e03f 100644
--- a/vcl/source/filter/png/PngImageReader.cxx
+++ b/vcl/source/filter/png/PngImageReader.cxx
@@ -190,6 +190,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
             aBitmap = Bitmap(Size(width, height), vcl::PixelFormat::N24_BPP);
             {
                 pWriteAccess = BitmapScopedWriteAccess(aBitmap);
+                if (!pWriteAccess)
+                {
+                    png_destroy_read_struct(&pPng, &pInfo, nullptr);
+                    return false;
+                }
                 ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat();
                 if (eFormat == ScanlineFormat::N24BitTcBgr)
                     png_set_bgr(pPng);
@@ -227,6 +232,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
                 aBitmap = Bitmap(Size(width, height), vcl::PixelFormat::N32_BPP);
                 {
                     pWriteAccess = BitmapScopedWriteAccess(aBitmap);
+                    if (!pWriteAccess)
+                    {
+                        png_destroy_read_struct(&pPng, &pInfo, nullptr);
+                        return false;
+                    }
                     ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat();
                     if (eFormat == ScanlineFormat::N32BitTcAbgr
                         || eFormat == ScanlineFormat::N32BitTcBgra)
@@ -275,6 +285,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
                 aBitmapAlpha = AlphaMask(Size(width, height), nullptr);
                 {
                     pWriteAccess = BitmapScopedWriteAccess(aBitmap);
+                    if (!pWriteAccess)
+                    {
+                        png_destroy_read_struct(&pPng, &pInfo, nullptr);
+                        return false;
+                    }
                     ScanlineFormat eFormat = pWriteAccess->GetScanlineFormat();
                     if (eFormat == ScanlineFormat::N24BitTcBgr)
                         png_set_bgr(pPng);
@@ -319,7 +334,11 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
             aBitmap.Erase(COL_WHITE);
             {
                 pWriteAccess = BitmapScopedWriteAccess(aBitmap);
-
+                if (!pWriteAccess)
+                {
+                    png_destroy_read_struct(&pPng, &pInfo, nullptr);
+                    return false;
+                }
                 aRows = std::vector<std::vector<png_byte>>(height);
                 for (auto& rRow : aRows)
                     rRow.resize(aRowSizeBytes, 0);