[Libreoffice-commits] core.git: 2 commits - vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/itiff/itiff.cxx |    4 +++-
 vcl/source/gdi/metaact.cxx        |    2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

New commits:
commit ab2a44f81bf5035fe85f3fb7494a910a75055041
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jan 6 20:38:57 2023 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Jan 7 10:56:44 2023 +0000

    ofz#54567 Out-of-memory
    
    Change-Id: If7a3f75aea614bf136049efc9d04ff404acbb170
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145165
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index a611810a9aec..a306317b60b0 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -127,6 +127,7 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
     Animation aAnimation;
 
     const bool bFuzzing = utl::ConfigManager::IsFuzzing();
+    uint64_t nTotalPixelsRequired = 0;
 
     do
     {
@@ -160,7 +161,8 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
         {
             const uint64_t MAX_PIXEL_SIZE = 150000000;
             const uint64_t MAX_TILE_SIZE = 100000000;
-            if (TIFFTileSize64(tif) > MAX_TILE_SIZE || nPixelsRequired > 
MAX_PIXEL_SIZE)
+            nTotalPixelsRequired += nPixelsRequired;
+            if (TIFFTileSize64(tif) > MAX_TILE_SIZE || nTotalPixelsRequired > 
MAX_PIXEL_SIZE)
             {
                 SAL_WARN("filter.tiff", "skipping large tiffs");
                 break;
commit 8ddb962846020d1534454fdeea628bb72d92ba40
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jan 6 20:27:01 2023 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Jan 7 10:56:36 2023 +0000

    ofz#54707 Integer-overflow
    
    Change-Id: I3b448ed2752bfbffa2f38db3fe0d4099b9f83b2a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145164
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index c3d1d11b9a4c..cbec9f54a1d5 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1152,6 +1152,8 @@ MetaMaskScaleAction::MetaMaskScaleAction( const Point& 
rPt, const Size& rSz,
 
 void MetaMaskScaleAction::Execute( OutputDevice* pOut )
 {
+    if (!AllowRect(pOut->LogicToPixel(tools::Rectangle(maPt, maSz))))
+        return;
     pOut->DrawMask( maPt, maSz, maBmp, maColor );
 }