vcl/source/filter/itiff/itiff.cxx | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
New commits: commit 3b6316f25e6679aeaf70740acbaf8bb4a68bbece Author: Caolán McNamara <caol...@redhat.com> AuthorDate: Thu Nov 17 12:28:41 2022 +0000 Commit: Caolán McNamara <caol...@redhat.com> CommitDate: Thu Nov 17 17:13:13 2022 +0100 ofz#53452 Out-of-memory Change-Id: I12e9a87f675d2e625a49d9736bca331a1d3879c0 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142837 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caol...@redhat.com> diff --git a/vcl/source/filter/itiff/itiff.cxx b/vcl/source/filter/itiff/itiff.cxx index 3e308f3019d3..ed74d00ddeb9 100644 --- a/vcl/source/filter/itiff/itiff.cxx +++ b/vcl/source/filter/itiff/itiff.cxx @@ -184,6 +184,25 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) } } } + + uint16_t Compression; + if (TIFFGetField(tif, TIFFTAG_COMPRESSION, &Compression) == 1) + { + if (Compression == COMPRESSION_CCITTFAX4) + { + if (TIFFIsTiled(tif)) + { + uint32_t tw; + if (TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw) == 1) + { + uint32_t DspRuns; + bOk = !o3tl::checked_multiply(tw, static_cast<uint32_t>(4), DspRuns) && DspRuns < MAX_PIXEL_SIZE; + SAL_WARN_IF(!bOk, "filter.tiff", "skipping oversized tiff tile width: " << tw); + } + } + } + } + } if (!bOk)