diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-07-20 10:06:59 +0100 |
---|---|---|
committer | David Tardon <dtardon@redhat.com> | 2015-07-20 10:42:53 +0000 |
commit | 29ab9be99e3a537ad1de857ab9c868adc0b0aca7 (patch) | |
tree | 0188fbcadbb70f0abc9c8658343f4db61d7d6b9e /filter | |
parent | 997e69c66bf6488184f08d59126886baaba94ffe (diff) |
ensure loop ends eventually
Change-Id: I318385286fcc27ffb2d938237d83e793564d2525
(cherry picked from commit c02e79874951ba86d926186e284612806d8bc0a3)
Reviewed-on: https://gerrit.libreoffice.org/17215
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'filter')
-rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-6.tiff | bin | 0 -> 259 bytes | |||
-rw-r--r-- | filter/source/graphicfilter/itiff/ccidecom.cxx | 39 |
2 files changed, 22 insertions, 17 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-6.tiff b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff Binary files differnew file mode 100644 index 000000000000..4e6cc0ed5d4b --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index de0299f717fc..4752aa04c880 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -886,36 +886,41 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits, } } - sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits, sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) { - sal_uInt16 nPos,nLo; - sal_uInt8 nData; - // here the number of bits belonging together is being counted // which all have the color nBlackOrWhite (0xff oder 0x00) // from the position nBitPos on - - nPos=nBitPos; - for (;;) { - if (nPos>=nDataSizeBits) { + sal_uInt16 nPos = nBitPos; + for (;;) + { + if (nPos>=nDataSizeBits) + { nPos=nDataSizeBits; break; } - nData=pData[nPos>>3]; - nLo=nPos & 7; - if ( nLo==0 && nData==nBlackOrWhite) nPos+=8; - else { - if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) break; - nPos++; + sal_uInt8 nData = pData[nPos>>3]; + sal_uInt16 nLo = nPos & 7; + if (nLo==0 && nData==nBlackOrWhite) + { + //fail on overflow attempt + if (nPos > SAL_MAX_UINT16-8) + return 0; + nPos+=8; + } + else + { + if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) + break; + ++nPos; } } - if (nPos<=nBitPos) return 0; - else return nPos-nBitPos; + if (nPos<=nBitPos) + return 0; + return nPos-nBitPos; } - void CCIDecompressor::Read1DScanlineData(sal_uInt8 * pTarget, sal_uInt16 nTargetBits) { sal_uInt16 nCode,nCodeBits,nDataBits,nTgtFreeByteBits; |