summaryrefslogtreecommitdiff
path: root/vcl
diff options
context:
space:
mode:
authorStephan Bergmann <sbergman@redhat.com>2017-11-21 08:58:04 +0100
committerStephan Bergmann <sbergman@redhat.com>2017-11-21 08:58:04 +0100
commitbb11e1283e3d49ec1bfe14c4271edbd49af3e3c1 (patch)
tree590fc3d10efe39acf3512920098f0958afa0e657 /vcl
parent11ca1f86f80984ec07f5051ab05f864d55db5974 (diff)
ASan heap-buffer-overflow
e.g. during CppunitTest_sd_misc_tests (see <https://ci.libreoffice.org/job/lo_ubsan/735/console>) after 66dbd4da3afcadb1393daf9be9cecff71b86509a "tdf#113918: Workaround: Load 1bpp indexed PNG as 8bpp indexed Bitmap". Looks like PNGReaderImpl::ImplDrawScanline also needs to special-case mnPngDepth == 1 in the mbTransparent case (and, TODO, also in the mbAlphaChannel case)? Change-Id: Ie6a0230ec606f7cc5aaf174b9c0075a3b4cb5b1d
Diffstat (limited to 'vcl')
-rw-r--r--vcl/source/gdi/pngread.cxx16
1 files changed, 16 insertions, 0 deletions
diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index bc218f8d9964..7a1f8ef46136 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -1328,6 +1328,22 @@ void PNGReaderImpl::ImplDrawScanline( sal_uInt32 nXStart, sal_uInt32 nXAdd )
for ( long nX = nXStart; nX < maOrigSize.Width(); nX += nXAdd, pTmp++ )
ImplSetAlphaPixel( nY, nX, *pTmp, mpTransTab[ *pTmp ] );
}
+ else if (mnPngDepth == 1 )
+ {
+ for ( long nX = nXStart, nShift = 0; nX < maOrigSize.Width(); nX += nXAdd )
+ {
+ nShift = (nShift - 1) & 7;
+
+ sal_uInt8 nCol;
+ if ( nShift == 0 )
+ nCol = *(pTmp++);
+ else
+ nCol = static_cast<sal_uInt8>( *pTmp >> nShift );
+ nCol &= 1;
+
+ ImplSetAlphaPixel( nY, nX, nCol, mpTransTab[ nCol ] );
+ }
+ }
else
{
for ( long nX = nXStart; nX < maOrigSize.Width(); nX += nXAdd, pTmp += 2 )