filter/source/graphicfilter/itiff/ccidecom.cxx | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
New commits:
commit a9665403cd997c1c593efc52682a87ffb3c1e87a
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Dec 2 09:26:54 2020 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Wed Dec 2 16:45:43 2020 +0100
ofz#27839 Timeout
use sal_uInt32 and truncate to limit instead of using sal_uInt16
Change-Id: I454fcf23ff272069f8e4499b1ce9674cfb8e4564
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107068
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx
b/filter/source/graphicfilter/itiff/ccidecom.cxx
index 9c9b916a1d8c..407aab17d669 100644
--- a/filter/source/graphicfilter/itiff/ccidecom.cxx
+++ b/filter/source/graphicfilter/itiff/ccidecom.cxx
@@ -871,12 +871,12 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget,
sal_uInt16 nTargetBits,
}
sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16
nDataSizeBits,
- sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite)
+ sal_uInt16 nBitPos, sal_uInt8
nBlackOrWhite)
{
// here the number of bits belonging together is being counted
// which all have the color nBlackOrWhite (0xff or 0x00)
// from the position nBitPos on
- sal_uInt16 nPos = nBitPos;
+ sal_uInt32 nPos = nBitPos;
for (;;)
{
if (nPos>=nDataSizeBits)
@@ -888,9 +888,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 *
pData, sal_uInt16 nDataS
sal_uInt16 nLo = nPos & 7;
if (nLo==0 && nData==nBlackOrWhite)
{
- //fail on overflow attempt
- if (nPos > SAL_MAX_UINT16-8)
- return 0;
nPos+=8;
}
else
@@ -900,8 +897,6 @@ sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 *
pData, sal_uInt16 nDataS
++nPos;
}
}
- if (nPos<=nBitPos)
- return 0;
return nPos-nBitPos;
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
