filter/qa/cppunit/data/tiff/fail/crash-3.tiff |binary
filter/source/graphicfilter/itiff/itiff.cxx | 2 ++
2 files changed, 2 insertions(+)
New commits:
commit fcdddbd30a8b5cf6a5cc4d2ff28b7d4a20f8ec6b
Author: Caolán McNamara <caol...@redhat.com>
Date: Sun Jul 19 21:32:05 2015 +0100
check np bounds again
Change-Id: I0fb61954b2eaf0c015d7bdefe9f03bd459b31501
diff --git a/filter/qa/cppunit/data/tiff/fail/crash-3.tiff
b/filter/qa/cppunit/data/tiff/fail/crash-3.tiff
new file mode 100644
index 0000000..4aa2393
Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-3.tiff
differ
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx
b/filter/source/graphicfilter/itiff/itiff.cxx
index 0913fd1..b18db6b 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -640,6 +640,8 @@ bool TIFFReader::ReadMap()
pTIFF->Seek(pStripOffsets[nStrip]);
aLZWDecom.StartDecompression(*pTIFF);
}
+ if (np >= SAL_N_ELEMENTS(pMap))
+ return false;
if ( ( aLZWDecom.Decompress( pMap[ np ], nBytesPerRow ) !=
nBytesPerRow ) || pTIFF->GetError() )
return false;
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
