diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-07-19 21:25:46 +0100 |
---|---|---|
committer | Andras Timar <andras.timar@collabora.com> | 2015-08-06 12:56:34 +0200 |
commit | 67c7bdb92c06f3bc376ab8cf7f20fab39c898dce (patch) | |
tree | f2754460c9027844bb69514211755cfcbc1a57bc /filter | |
parent | 90949fa130cd6a31ae614a3fa3b38c8b13972d9b (diff) |
check np bounds
Change-Id: Id16ae9325f3c67792941b9c88d83435aa98282ca
(cherry picked from commit be4e1141be7cd54cf5362d3de534050db5505437)
Reviewed-on: https://gerrit.libreoffice.org/17199
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
-rw-r--r-- | filter/qa/cppunit/data/tiff/fail/crash-2.tiff | bin | 0 -> 260 bytes | |||
-rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 2 |
2 files changed, 2 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-2.tiff b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff Binary files differnew file mode 100644 index 000000000000..aadd99f33d2d --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 834c437e7cc0..4599af97dc0c 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -608,6 +608,8 @@ bool TIFFReader::ReadMap() pTIFF->Seek( pStripOffsets[ nStrip ] ); aCCIDecom.StartDecompression( *pTIFF ); } + if (np >= SAL_N_ELEMENTS(pMap)) + return false; if ( !aCCIDecom.DecompressScanline( pMap[ np ], nImageWidth * nBitsPerSample * nSamplesPerPixel / nPlanes, np + 1 == nPlanes ) ) return false; if ( pTIFF->GetError() ) |