diff options
| -rw-r--r-- | filter/qa/cppunit/data/tiff/fail/hang-10.tiff | bin | 0 -> 5254 bytes | |||
| -rw-r--r-- | filter/source/graphicfilter/itiff/lzwdecom.cxx | 12 |
2 files changed, 12 insertions, 0 deletions
diff --git a/filter/qa/cppunit/data/tiff/fail/hang-10.tiff b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff Binary files differnew file mode 100644 index 000000000000..e5e9ebc3d028 --- /dev/null +++ b/filter/qa/cppunit/data/tiff/fail/hang-10.tiff diff --git a/filter/source/graphicfilter/itiff/lzwdecom.cxx b/filter/source/graphicfilter/itiff/lzwdecom.cxx index 82f6accd073f..5fb7514d62db 100644 --- a/filter/source/graphicfilter/itiff/lzwdecom.cxx +++ b/filter/source/graphicfilter/itiff/lzwdecom.cxx @@ -19,6 +19,8 @@ #include "lzwdecom.hxx" +#include <algorithm> +#include <vector> #define MAX_TABLE_SIZE 4096 @@ -161,8 +163,18 @@ void LZWDecompressor::AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData return; } + std::vector<sal_uInt16> aSeenIndexes; while (pTable[nCodeFirstData].nDataCount>1) + { + if (std::find(aSeenIndexes.begin(), aSeenIndexes.end(), nCodeFirstData) != aSeenIndexes.end()) + { + SAL_WARN("filter.tiff", "Loop in chain"); + bEOIFound = true; + return; + } + aSeenIndexes.push_back(nCodeFirstData); nCodeFirstData=pTable[nCodeFirstData].nPrevCode; + } pTable[nTableSize].nPrevCode=nPrevCode; pTable[nTableSize].nDataCount=pTable[nPrevCode].nDataCount+1; |