detect and reject loop in tif

Change-Id: I77d315fa432a3eb1a65539489a2ba6da8508b283

2 files changed, 12 insertions, 0 deletions

diff --git a/filter/qa/cppunit/data/tiff/fail/hang-10.tiff b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff
new file mode 100644
index 000000000000..e5e9ebc3d028
--- /dev/null
+++ b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff
diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx b/filter/source/graphicfilter/itiff/lzwdecom.cxx
index 82f6accd073f..5fb7514d62db 100644
--- a/filter/source/graphicfilter/itiff/lzwdecom.cxx
+++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx
@@ -19,6 +19,8 @@
 
 
 #include "lzwdecom.hxx"
+#include <algorithm>
+#include <vector>
 
 #define MAX_TABLE_SIZE 4096
 
@@ -161,8 +163,18 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData
         return;
     }
 
+    std::vector<sal_uInt16> aSeenIndexes;
     while (pTable[nCodeFirstData].nDataCount>1)
+    {
+        if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(), nCodeFirstData) != aSeenIndexes.end())
+        {
+            SAL_WARN("filter.tiff", "Loop in chain");
+            bEOIFound = true;
+            return;
+        }
+        aSeenIndexes.push_back(nCodeFirstData);
         nCodeFirstData=pTable[nCodeFirstData].nPrevCode;
+    }
 
     pTable[nTableSize].nPrevCode=nPrevCode;
     pTable[nTableSize].nDataCount=pTable[nPrevCode].nDataCount+1;