filter/qa/cppunit/data/tiff/fail/hang-6.tiff |binary filter/source/graphicfilter/itiff/ccidecom.cxx | 39 ++++++++++++++----------- 2 files changed, 22 insertions(+), 17 deletions(-)
New commits: commit 60ec59d671058d8996cd0edf683078aae34d96af Author: Caolán McNamara <caol...@redhat.com> Date: Mon Jul 20 10:06:59 2015 +0100 ensure loop ends eventually Change-Id: I318385286fcc27ffb2d938237d83e793564d2525 (cherry picked from commit c02e79874951ba86d926186e284612806d8bc0a3) Reviewed-on: https://gerrit.libreoffice.org/17214 Reviewed-by: David Tardon <dtar...@redhat.com> Tested-by: David Tardon <dtar...@redhat.com> diff --git a/filter/qa/cppunit/data/tiff/fail/hang-6.tiff b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff new file mode 100644 index 0000000..4e6cc0e Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-6.tiff differ diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 2477542..c1447b16 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -886,36 +886,41 @@ void CCIDecompressor::FillBits(sal_uInt8 * pTarget, sal_uInt16 nTargetBits, } } - sal_uInt16 CCIDecompressor::CountBits(const sal_uInt8 * pData, sal_uInt16 nDataSizeBits, sal_uInt16 nBitPos, sal_uInt8 nBlackOrWhite) { - sal_uInt16 nPos,nLo; - sal_uInt8 nData; - // here the number of bits belonging together is being counted // which all have the color nBlackOrWhite (0xff oder 0x00) // from the position nBitPos on - - nPos=nBitPos; - for (;;) { - if (nPos>=nDataSizeBits) { + sal_uInt16 nPos = nBitPos; + for (;;) + { + if (nPos>=nDataSizeBits) + { nPos=nDataSizeBits; break; } - nData=pData[nPos>>3]; - nLo=nPos & 7; - if ( nLo==0 && nData==nBlackOrWhite) nPos+=8; - else { - if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) break; - nPos++; + sal_uInt8 nData = pData[nPos>>3]; + sal_uInt16 nLo = nPos & 7; + if (nLo==0 && nData==nBlackOrWhite) + { + //fail on overflow attempt + if (nPos > SAL_MAX_UINT16-8) + return 0; + nPos+=8; + } + else + { + if ( ((nData^nBlackOrWhite) & (0x80 >> nLo))!=0) + break; + ++nPos; } } - if (nPos<=nBitPos) return 0; - else return nPos-nBitPos; + if (nPos<=nBitPos) + return 0; + return nPos-nBitPos; } - void CCIDecompressor::Read1DScanlineData(sal_uInt8 * pTarget, sal_uInt16 nTargetBits) { sal_uInt16 nCode,nCodeBits,nDataBits,nTgtFreeByteBits;
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits