filter/qa/cppunit/data/tiff/fail/crash-5.tiff |binary filter/source/graphicfilter/itiff/itiff.cxx | 2 ++ 2 files changed, 2 insertions(+)
New commits: commit 1b50cbe9aac1f57ac325799931abcd60e88d51b6 Author: Caolán McNamara <caol...@redhat.com> Date: Mon Jul 20 08:50:27 2015 +0100 check np bounds yet again Change-Id: Id3f6fdc0ebed9711acec5d71f404e7a6072b765c (cherry picked from commit bca4d6f896fb12ceff37476c43ea8892898dd385) Reviewed-on: https://gerrit.libreoffice.org/17208 Reviewed-by: Michael Meeks <michael.me...@collabora.com> Tested-by: Michael Meeks <michael.me...@collabora.com> diff --git a/filter/qa/cppunit/data/tiff/fail/crash-5.tiff b/filter/qa/cppunit/data/tiff/fail/crash-5.tiff new file mode 100644 index 0000000..4849edf Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/crash-5.tiff differ diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 20d3768..69067c5 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -682,6 +682,8 @@ bool TIFFReader::ReadMap( sal_uLong nMinPercent, sal_uLong nMaxPercent ) pTIFF->Seek(pStripOffsets[nStrip]); } nRowBytesLeft = nBytesPerRow; + if (np >= SAL_N_ELEMENTS(pMap)) + return false; pdst=pMap[ np ]; do {
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits