diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 10:06:59 +0100 |
---|---|---|
committer | Andras Timar <andras.timar@collabora.com> | 2015-08-03 17:51:34 +0200 |
commit | 801128f3d29770c0cd27d1afb6d5010bb40f10a9 (patch) | |
tree | 87ea303f6770d4156283de27b076641e7cb7b33f /filter/source | |
parent | 874814ec0078bd5ec91c6265f65691a734475671 (diff) |
ensure loop ends eventually
Change-Id: I318385286fcc27ffb2d938237d83e793564d2525
(cherry picked from commit c02e79874951ba86d926186e284612806d8bc0a3)
Reviewed-on: https://gerrit.libreoffice.org/17215
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter/source')
-rw-r--r-- | filter/source/graphicfilter/itiff/ccidecom.cxx | 39 |
1 files changed, 22 insertions, 17 deletions
diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index de0299f717fc..4752aa04c880 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -886,36 +886,41 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits, } } - sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits, sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) { - sal_uInt16 nPos,nLo; - sal_uInt8 nData; - // here the number of bits belonging together is being counted // which all have the color nBlackOrWhite (0xff oder 0x00) // from the position nBitPos on - - nPos=nBitPos; - for (;;) { - if (nPos>=nDataSizeBits) { + sal_uInt16 nPos = nBitPos; + for (;;) + { + if (nPos>=nDataSizeBits) + { nPos=nDataSizeBits; break; } - nData=pData[nPos>>3]; - nLo=nPos & 7; - if ( nLo==0 && nData==nBlackOrWhite) nPos+=8; - else { - if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) break; - nPos++; + sal_uInt8 nData = pData[nPos>>3]; + sal_uInt16 nLo = nPos & 7; + if (nLo==0 && nData==nBlackOrWhite) + { + //fail on overflow attempt + if (nPos > SAL_MAX_UINT16-8) + return 0; + nPos+=8; + } + else + { + if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) + break; + ++nPos; } } - if (nPos<=nBitPos) return 0; - else return nPos-nBitPos; + if (nPos<=nBitPos) + return 0; + return nPos-nBitPos; } - void CCIDecompressor::Read1DScanlineData(sal_uInt8 * pTarget, sal_uInt16 nTargetBits) { sal_uInt16 nCode,nCodeBits,nDataBits,nTgtFreeByteBits; |