diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-23 11:01:00 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-02-27 11:22:58 +0100 |
| commit | 2df0902dc403d7c01c0a7e571c8dfe102887e9c0 (patch) | |
| tree | d3d5d9d2f0ae019a466ba3c67db3ceff87003371 | |
| parent | 42097cef4095107a0e157ce04a04c0f0c22df6b2 (diff) | |
ofz: don't read data that isn't there
Change-Id: I7fdcb78bde8f650c1a57d34177d8993a6d8a0a2f
(cherry picked from commit ee619fb344c7e8f491e09bd256df7f8567af9bef)
improve scoping
Change-Id: Ic79d46da4e322a0f52981c3a3df65f7f0294fdd8
(cherry picked from commit 840ad0a88045021c58644404a099a3678a371020)
make this a little clearer
no logic change intended
Change-Id: Ibfc46d0aba9e220be54270734e0cdfbc123be9a5
(cherry picked from commit 46b1b5dd2a5368663fd56434160fa126f1a54d84)
Reviewed-on: https://gerrit.libreoffice.org/34573
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 4c9383e1354be0954c5f7cf8906f334ae079baeb)
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 4ba2db797f8f..0e78457c3ac2 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -788,7 +788,7 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, sal_uLong nBitsPos, sal_u bool TIFFReader::ConvertScanline(sal_Int32 nY) { - sal_uInt32 nRed, nGreen, nBlue, ns, nVal, nByteCount; + sal_uInt32 nRed, nGreen, nBlue, ns, nVal; sal_uInt8 nByteVal; if ( nDstBitsPerPixel == 24 ) @@ -999,11 +999,18 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY) case 1 : { + sal_uInt32 nByteCount = nImageWidth >> 3; + + sal_uInt32 nBytesNeeded = nByteCount; + if (nImageWidth & 7) + ++nBytesNeeded; + if (pt + nBytesNeeded > ptend) + return false; + if ( bByteSwap ) { sal_Int32 nx = 0; - nByteCount = ( nImageWidth >> 3 ) + 1; - while ( --nByteCount ) + while (nByteCount--) { nByteVal = *pt++; pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 ); @@ -1035,8 +1042,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY) else { sal_Int32 nx = 7; - nByteCount = ( nImageWidth >> 3 ) + 1; - while ( --nByteCount ) + while (nByteCount--) { nByteVal = *pt++; pAcc->SetPixelIndex( nY, nx, nByteVal & 1 ); |