vcl/source/gdi/pngread.cxx | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
New commits:
commit 1c93732e98c4ce1182a132eef416adbf6ae1fffa
Author: Stephan Bergmann <sberg...@redhat.com>
Date: Tue Nov 21 08:58:04 2017 +0100
ASan heap-buffer-overflow
e.g. during CppunitTest_sd_misc_tests (see
<https://ci.libreoffice.org/job/lo_ubsan/735/console>) after
66dbd4da3afcadb1393daf9be9cecff71b86509a "tdf#113918: Workaround: Load 1bpp
indexed PNG as 8bpp indexed Bitmap". Looks like
PNGReaderImpl::ImplDrawScanline
also needs to special-case mnPngDepth == 1 in the mbTransparent case (and,
TODO,
also in the mbAlphaChannel case)?
Change-Id: Ie6a0230ec606f7cc5aaf174b9c0075a3b4cb5b1d
(cherry picked from commit bb11e1283e3d49ec1bfe14c4271edbd49af3e3c1)
Reviewed-on: https://gerrit.libreoffice.org/45022
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Michael Stahl <mst...@redhat.com>
diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index 62172d12a8c5..7c9fb7870019 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -1325,6 +1325,22 @@ void PNGReaderImpl::ImplDrawScanline( sal_uInt32
nXStart, sal_uInt32 nXAdd )
for ( long nX = nXStart; nX < maOrigSize.Width(); nX
+= nXAdd, pTmp++ )
ImplSetAlphaPixel( nY, nX, *pTmp, mpTransTab[
*pTmp ] );
}
+ else if (mnPngDepth == 1 )
+ {
+ for ( long nX = nXStart, nShift = 0; nX <
maOrigSize.Width(); nX += nXAdd )
+ {
+ nShift = (nShift - 1) & 7;
+
+ sal_uInt8 nCol;
+ if ( nShift == 0 )
+ nCol = *(pTmp++);
+ else
+ nCol = static_cast<sal_uInt8>( *pTmp >> nShift
);
+ nCol &= 1;
+
+ ImplSetAlphaPixel( nY, nX, nCol, mpTransTab[ nCol
] );
+ }
+ }
else
{
for ( long nX = nXStart; nX < maOrigSize.Width(); nX
+= nXAdd, pTmp += 2 )
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
