summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-07-21 10:10:50 +0100
committerCaolán McNamara <caolanm@redhat.com>2015-07-21 10:12:41 +0100
commit34d062147c16090fa42c27ac7960e3f5e3b65d2b (patch)
treeeea4b83c58c79cd3e3f58650f81c804c1a033136
parent3d2f43438d4fe6947965a98262b0db42c8d5e680 (diff)
reject invalid tiff dimensions
Change-Id: I64e77f12cb016a7f4a9d21c732aaeaae7959da76
-rw-r--r--filter/qa/cppunit/data/tiff/fail/crash-7.tiffbin0 -> 179 bytes
-rw-r--r--filter/source/graphicfilter/itiff/itiff.cxx2
2 files changed, 2 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-7.tiff b/filter/qa/cppunit/data/tiff/fail/crash-7.tiff
new file mode 100644
index 000000000000..0056f9dcb8d5
--- /dev/null
+++ b/filter/qa/cppunit/data/tiff/fail/crash-7.tiff
Binary files differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 180b1c379003..c730e81b38a6 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -1330,6 +1330,8 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
}
if ( !nBitsPerSample || ( nBitsPerSample > 32 ) )
bStatus = false;
+ if (nImageWidth < 0 || nImageLength < 0)
+ bStatus = false;
if ( bStatus )
{
if ( nMaxSampleValue == 0 )