diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 11:40:34 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-03 17:51:36 +0200 |
| commit | 6abed1b9c7f9767d680d063088dc6a23cc122111 (patch) | |
| tree | a098cb8f4ff879ac2aadaa7b58943dfab9f21377 /filter | |
| parent | 27f3821c44b7d326c116183fb063c9254d55ccc8 (diff) | |
fail on short read
Change-Id: I7215cf8d8b1e4a4156c87507018de3c2b7ed08d8
(cherry picked from commit 8eaef6b5217eecaa111c80e426bdf225481a71fb)
Reviewed-on: https://gerrit.libreoffice.org/17221
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-8.tiff | bin | 0 -> 272 bytes | |||
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 6 |
2 files changed, 4 insertions, 2 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-8.tiff b/filter/qa/cppunit/data/tiff/fail/hang-8.tiff Binary files differnew file mode 100644 index 000000000000..c45859720490 --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-8.tiff diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 0c3fbd6ecb27..f8bc19354f9c 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -669,7 +669,7 @@ bool TIFFReader::ReadMap( sal_uLong nMinPercent, sal_uLong nMaxPercent ) } else if ( nCompression == 32773 ) { - sal_uLong nStrip,nRecCount,nRowBytesLeft,np,i; + sal_uLong nStrip,nRecCount,np,i; sal_uInt8 * pdst; nStrip = 0; if ( nStrip >= nNumStripOffsets ) @@ -686,7 +686,7 @@ bool TIFFReader::ReadMap( sal_uLong nMinPercent, sal_uLong nMaxPercent ) return false; pTIFF->Seek(pStripOffsets[nStrip]); } - nRowBytesLeft = nBytesPerRow; + sal_uLong nRowBytesLeft = nBytesPerRow; if (np >= SAL_N_ELEMENTS(pMap)) return false; pdst=pMap[ np ]; @@ -700,6 +700,8 @@ bool TIFFReader::ReadMap( sal_uLong nMinPercent, sal_uLong nMaxPercent ) if ( nRecCount > nRowBytesLeft ) return false; pTIFF->Read(pdst,nRecCount); + if (!pTIFF->good()) + return false; pdst+=nRecCount; nRowBytesLeft-=nRecCount; } |