[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/itiff/itiff.cxx |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

New commits:
commit 0adee3ac5080723b5f0605c13f02ef358d848a0b
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun May 29 12:40:36 2022 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sun May 29 15:34:30 2022 +0200

    crashtesting: failure on loading gnome635181-1.tiff
    
    Change-Id: I5dd9552eb267ffb67aa0aae36b474eb28790b5c0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135091
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index 59021b8c4999..6f81dffd08ef 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -120,7 +120,7 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
             break;
         }
 
-        if (w > SAL_MAX_INT32 / 8 || h > SAL_MAX_INT32 / 8)
+        if (w > SAL_MAX_INT32 / 32 || h > SAL_MAX_INT32 / 32)
         {
             SAL_WARN("filter.tiff", "image too large");
             break;
@@ -147,10 +147,20 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
         if (TIFFReadRGBAImageOriented(tif, w, h, raster.data(), 
ORIENTATION_TOPLEFT, 1))
         {
             Bitmap bitmap(Size(w, h), vcl::PixelFormat::N24_BPP);
-            AlphaMask bitmapAlpha(Size(w, h));
-
             BitmapScopedWriteAccess access(bitmap);
+            if (!access)
+            {
+                SAL_WARN("filter.tiff", "cannot create image " << w << " x " 
<< h);
+                break;
+            }
+
+            AlphaMask bitmapAlpha(Size(w, h));
             AlphaScopedWriteAccess accessAlpha(bitmapAlpha);
+            if (!accessAlpha)
+            {
+                SAL_WARN("filter.tiff", "cannot create alpha " << w << " x " 
<< h);
+                break;
+            }
 
             /*
                 ORIENTATION_TOPLEFT = 1