diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-07-17 09:59:23 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-06 12:56:29 +0200 |
| commit | a95100b3258d0016107fbaef576f5e94b3dd4bc5 (patch) | |
| tree | 96e6cef6f9fea42c005000fe6e8e31b95979fa0a /filter | |
| parent | ace6fcc860d9f8d6c620bad62727acb6fdd9ce22 (diff) | |
detect another loop in tif format
Change-Id: I950f751277d9080b4fc00c38f63453cce81bcc32
(cherry picked from commit 49bf2c6700d8f0fc9155ac2d06bf0a7bd84915d8)
Reviewed-on: https://gerrit.libreoffice.org/17154
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-2.tiff | bin | 0 -> 111 bytes | |||
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 11 |
2 files changed, 10 insertions, 1 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-2.tiff b/filter/qa/cppunit/data/tiff/fail/hang-2.tiff Binary files differnew file mode 100644 index 000000000000..28ec8c0d3c2a --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-2.tiff diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 9ae2a0639eab..80c859ccc2ba 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1178,10 +1178,19 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) { sal_uInt32 nOffset = nFirstIfd; + std::vector<sal_uInt32> aSeenOffsets; // calculate length of TIFF file do { - pTIFF->Seek( nOrigPos + nOffset ); + if (std::find(aSeenOffsets.begin(), aSeenOffsets.end(), nOffset) != aSeenOffsets.end()) + { + SAL_WARN("filter.tiff", "Parsing error: " << nOffset << + " already processed, format loop"); + bStatus = false; + break; + } + pTIFF->Seek(nOrigPos + nOffset); + aSeenOffsets.push_back(nOffset); if( pTIFF->GetError() ) { |