diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-02-22 20:39:13 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-02-23 09:13:43 +0000 |
| commit | 2166fd06156c8f31948e755b5893911d93fcb6a2 (patch) | |
| tree | 17b9c902b12a8ecb5868b9e9513ecad7ef86aa4e /filter | |
| parent | 95396dbcaf035655f1102480c146e6cbc9f44d70 (diff) | |
ofz: don't read data that isn't there
Change-Id: I9f730c321755cde169d940b49fc93bbe057ead57
(cherry picked from commit c5b1a01ddfa54156b4fa8e542d6936908257ca93)
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index d7a26ead6670..0ef0081be8fc 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -929,12 +929,16 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY) { sal_uLong nMinMax = ( ( 1 << nDstBitsPerPixel ) - 1 ) / ( nMaxSampleValue - nMinSampleValue ); sal_uInt8* pt = pMap[ 0 ]; + sal_uInt8* ptend = pt + nBytesPerRow; sal_uInt8 nShift; switch ( nDstBitsPerPixel ) { case 8 : { + if (pt + nImageWidth > ptend) + return false; + if ( bByteSwap ) { if ( nPredictor == 2 ) |