diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-08-24 15:31:41 +0100 |
---|---|---|
committer | David Tardon <dtardon@redhat.com> | 2015-08-25 07:21:23 +0000 |
commit | aed68b0c79b4edac79d18a7c273ab1bf21665614 (patch) | |
tree | da999684e1a01d82590dd500fbc02cb7c355958b /filter | |
parent | d8b8bb7bb6a4b50190efd9f1f6909f42e353546c (diff) |
detect and reject loop in tif
Change-Id: I77d315fa432a3eb1a65539489a2ba6da8508b283
(cherry picked from commit 6b82437dca30eba0f0c9dde6fdc84cb8f7740f8f)
Reviewed-on: https://gerrit.libreoffice.org/17957
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
-rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-10.tiff | bin | 0 -> 5254 bytes | |||
-rw-r--r-- | filter/source/graphicfilter/itiff/lzwdecom.cxx | 12 |
2 files changed, 12 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-10.tiff b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff Binary files differnew file mode 100644 index 000000000000..e5e9ebc3d028 --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx b/filter/source/graphicfilter/itiff/lzwdecom.cxx index 82f6accd073f..5fb7514d62db 100644 --- a/filter/source/graphicfilter/itiff/lzwdecom.cxx +++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx @@ -19,6 +19,8 @@ #include "lzwdecom.hxx" +#include <algorithm> +#include <vector> #define MAX_TABLE_SIZE 4096 @@ -161,8 +163,18 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData return; } + std::vector<sal_uInt16> aSeenIndexes; while (pTable[nCodeFirstData].nDataCount>1) + { + if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(), nCodeFirstData) != aSeenIndexes.end()) + { + SAL_WARN("filter.tiff", "Loop in chain"); + bEOIFound = true; + return; + } + aSeenIndexes.push_back(nCodeFirstData); nCodeFirstData=pTable[nCodeFirstData].nPrevCode; + } pTable[nTableSize].nPrevCode=nPrevCode; pTable[nTableSize].nDataCount=pTable[nPrevCode].nDataCount+1; |