diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-22 20:39:13 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-02-23 09:11:34 +0000 |
| commit | 3106e9eb06eafb82f77c7076d792fc45c8038d37 (patch) | |
| tree | c0f0af9e4689cfa07665c68315f9d948b40b2d82 /filter | |
| parent | 26b8ac1fddd43af3e864c7bcc3414074e54a7bf2 (diff) | |
ofz: don't read data that isn't there
Change-Id: I9f730c321755cde169d940b49fc93bbe057ead57
(cherry picked from commit c5b1a01ddfa54156b4fa8e542d6936908257ca93)
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index f7956310a646..df212685e7f5 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -927,12 +927,16 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY) { sal_uLong nMinMax = ( ( 1 << nDstBitsPerPixel ) - 1 ) / ( nMaxSampleValue - nMinSampleValue ); sal_uInt8* pt = pMap[ 0 ]; + sal_uInt8* ptend = pt + nBytesPerRow; sal_uInt8 nShift; switch ( nDstBitsPerPixel ) { case 8 : { + if (pt + nImageWidth > ptend) + return false; + if ( bByteSwap ) { if ( nPredictor == 2 ) |