diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 09:24:48 +0100 |
|---|---|---|
| committer | Michael Meeks <michael.meeks@collabora.com> | 2015-07-20 09:14:04 +0000 |
| commit | f391df6c4616910a7f3cffb4d16a2e22531e6a90 (patch) | |
| tree | 7c5949bf1d6f2620e4e1bc611e71ed7ed81283ad /filter | |
| parent | 1b50cbe9aac1f57ac325799931abcd60e88d51b6 (diff) | |
final check np bounds
Change-Id: I9213bb2cc059e05e286598edac03bd72c84db876
(cherry picked from commit dcbbe7741a08f6076f9e020f90cbb730c1edafb9)
Reviewed-on: https://gerrit.libreoffice.org/17213
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/qa/cppunit/data/tiff/fail/crash-6.tiff | bin | 0 -> 260 bytes | |||
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 2 |
2 files changed, 2 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-6.tiff b/filter/qa/cppunit/data/tiff/fail/crash-6.tiff Binary files differnew file mode 100644 index 000000000000..907b5101473e --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/crash-6.tiff diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 69067c5b44e3..3f7d72834bcf 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -561,6 +561,8 @@ bool TIFFReader::ReadMap( sal_uLong nMinPercent, sal_uLong nMaxPercent ) if ( nStrip >= nNumStripOffsets ) return false; pTIFF->Seek( pStripOffsets[ nStrip ] + ( ny % GetRowsPerStrip() ) * nStripBytesPerRow ); + if (np >= SAL_N_ELEMENTS(pMap)) + return false; pTIFF->Read( pMap[ np ], nBytesPerRow ); if ( pTIFF->GetError() ) return false; |