[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/itiff/itiff.cxx |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

New commits:
commit 3b6316f25e6679aeaf70740acbaf8bb4a68bbece
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Nov 17 12:28:41 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Nov 17 17:13:13 2022 +0100

    ofz#53452 Out-of-memory
    
    Change-Id: I12e9a87f675d2e625a49d9736bca331a1d3879c0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142837
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index 3e308f3019d3..ed74d00ddeb9 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -184,6 +184,25 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
                     }
                 }
             }
+
+            uint16_t Compression;
+            if (TIFFGetField(tif, TIFFTAG_COMPRESSION, &Compression) == 1)
+            {
+                if (Compression == COMPRESSION_CCITTFAX4)
+                {
+                    if (TIFFIsTiled(tif))
+                    {
+                        uint32_t tw;
+                        if (TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw) == 1)
+                        {
+                            uint32_t DspRuns;
+                            bOk = !o3tl::checked_multiply(tw, 
static_cast<uint32_t>(4), DspRuns) && DspRuns < MAX_PIXEL_SIZE;
+                            SAL_WARN_IF(!bOk, "filter.tiff", "skipping 
oversized tiff tile width: " << tw);
+                        }
+                    }
+                }
+            }
+
         }
 
         if (!bOk)