filter/qa/cppunit/data/tiff/fail/crash-2.tiff |binary
filter/source/graphicfilter/itiff/itiff.cxx | 2 ++
2 files changed, 2 insertions(+)
New commits:
commit be4e1141be7cd54cf5362d3de534050db5505437
Author: Caolán McNamara <caol...@redhat.com>
Date: Sun Jul 19 21:25:46 2015 +0100
check np bounds
Change-Id: Id16ae9325f3c67792941b9c88d83435aa98282ca
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-2.tiff
b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff
new file mode 100644
index 0000000..aadd99f
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-2.tiff
differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx
b/filter/source/graphicfilter/itiff/itiff.cxx
index bd0cf6e..0913fd1 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -608,6 +608,8 @@ bool TIFFReader::ReadMap()
pTIFF->Seek( pStripOffsets[ nStrip ] );
aCCIDecom.StartDecompression( *pTIFF );
}
+ if (np >= SAL_N_ELEMENTS(pMap))
+ return false;
if ( !aCCIDecom.DecompressScanline( pMap[ np ], nImageWidth *
nBitsPerSample * nSamplesPerPixel / nPlanes, np + 1 == nPlanes ) )
return false;
if ( pTIFF->GetError() )
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
