diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-28 16:43:44 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-03-06 17:53:50 +0100 |
| commit | f46e9e343524905ad819e26da33c24e0e1599710 (patch) | |
| tree | 4c21f1a2b13f7b1e9722969807515fd57366c7b0 | |
| parent | cafd41ed87b3f24caf12fbf6f142875c3ddf44c0 (diff) | |
ofz#668: check nTargetBits size
Change-Id: I5cc7499cfdee58ffa480bb31dfc262d5b781180d
(cherry picked from commit 99c361be16eb3a21aa679a103db2d07ecd0f5d3c)
Reviewed-on: https://gerrit.libreoffice.org/34724
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
(cherry picked from commit aa5efe3ca9167c60049292e32b2b7c731e799e42)
| -rw-r--r-- | filter/source/graphicfilter/itiff/ccidecom.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 1cb7d7d53448..4fcb6b9a32ab 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -627,7 +627,9 @@ void CCIDecompressor::StartDecompression( SvStream & rIStream ) bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTargetBits, bool bLastLine ) { - bool b2D; + //Read[1|2]DScanlineData take a sal_uInt16, so its either limit here or expand there + if (nTargetBits > SAL_MAX_UINT16) + return false; if ( nEOLCount >= 5 ) // RTC (Return To Controller) return true; @@ -682,6 +684,7 @@ bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTarget if ( nOptions & CCI_OPTION_BYTEALIGNROW ) nInputBitsBufSize &= 0xfff8; + bool b2D; // is it a 2D row? if ( nOptions & CCI_OPTION_2D ) { |