dbaccess/source/ui/app/AppController.hxx | 2 - dbaccess/source/ui/app/AppDetailView.hxx | 2 - dbaccess/source/ui/app/AppIconControl.hxx | 2 - filter/qa/cppunit/data/tiff/fail/hang-9.tiff |binary filter/source/graphicfilter/itiff/itiff.cxx | 29 +++++++++++++++++---------- 5 files changed, 22 insertions(+), 13 deletions(-)
New commits: commit 97a0e7558b24792827d77217fb2d8b1106056963 Author: Caolán McNamara <[email protected]> Date: Mon Jul 20 12:28:03 2015 +0100 bail if offsets are past eof Change-Id: I4a8e78231befff498894ec92a1f38af206e13129 diff --git a/filter/qa/cppunit/data/tiff/fail/hang-9.tiff b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff new file mode 100644 index 0000000..ef314ab Binary files /dev/null and b/filter/qa/cppunit/data/tiff/fail/hang-9.tiff differ diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index 769c57e..180b1c3 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -57,6 +57,7 @@ private: BitmapWriteAccess* pMaskAcc; sal_uLong nOrigPos; // start position in pTIFF + sal_uLong nEndOfFile; // end of file position in pTIFF sal_uInt16 nDataType; @@ -131,6 +132,7 @@ public: , pAlphaMask(NULL) , pMaskAcc(NULL) , nOrigPos(0) + , nEndOfFile(0) , nDataType(0) , bByteSwap(false) , nNewSubFile(0) @@ -540,7 +542,7 @@ bool TIFFReader::ReadMap() { if ( nCompression == 1 || nCompression == 32771 ) { - sal_uLong np, nStrip, nStripBytesPerRow; + sal_uLong nStrip, nStripBytesPerRow; if ( nCompression == 1 ) nStripBytesPerRow = nBytesPerRow; @@ -548,7 +550,7 @@ bool TIFFReader::ReadMap() nStripBytesPerRow = ( nBytesPerRow + 1 ) & 0xfffffffe; for (sal_Int32 ny = 0; ny < nImageLength; ++ny) { - for ( np = 0; np < nPlanes; np++ ) + for (sal_uLong np = 0; np < nPlanes; ++np) { nStrip = ny / GetRowsPerStrip() + np * nStripsPerPlane; if ( nStrip >= nNumStripOffsets ) @@ -557,7 +559,7 @@ bool TIFFReader::ReadMap() if (np >= SAL_N_ELEMENTS(pMap)) return false; pTIFF->Read( pMap[ np ], nBytesPerRow ); - if ( pTIFF->GetError() ) + if (!pTIFF->good()) return false; } if ( !ConvertScanline( ny ) ) @@ -566,7 +568,7 @@ bool TIFFReader::ReadMap() } else if ( nCompression == 2 || nCompression == 3 || nCompression == 4 ) { - sal_uLong np, nStrip, nOptions; + sal_uLong nStrip, nOptions; if ( nCompression == 2 ) { nOptions = CCI_OPTION_BYTEALIGNROW; @@ -595,6 +597,9 @@ bool TIFFReader::ReadMap() nStrip = 0; if ( nStrip >= nNumStripOffsets ) return false; + sal_uLong nOffset = pStripOffsets[nStrip]; + if (nOffset > nEndOfFile) + return false; pTIFF->Seek(pStripOffsets[nStrip]); CCIDecompressor aCCIDecom( nOptions, nImageWidth ); @@ -603,14 +608,17 @@ bool TIFFReader::ReadMap() for (sal_Int32 ny = 0; ny < nImageLength; ++ny) { - for ( np = 0; np < nPlanes; np++ ) + for (sal_uLong np = 0; np < nPlanes; np++ ) { if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip ) { nStrip=ny/GetRowsPerStrip()+np*nStripsPerPlane; if ( nStrip >= nNumStripOffsets ) return false; - pTIFF->Seek( pStripOffsets[ nStrip ] ); + nOffset = pStripOffsets[nStrip]; + if (nOffset > nEndOfFile) + return false; + pTIFF->Seek(nOffset); aCCIDecom.StartDecompression( *pTIFF ); } if (np >= SAL_N_ELEMENTS(pMap)) @@ -627,7 +635,7 @@ bool TIFFReader::ReadMap() else if ( nCompression == 5 ) { LZWDecompressor aLZWDecom; - sal_uLong np, nStrip; + sal_uLong nStrip; nStrip=0; if ( nStrip >= nNumStripOffsets ) return false; @@ -635,7 +643,7 @@ bool TIFFReader::ReadMap() aLZWDecom.StartDecompression(*pTIFF); for (sal_Int32 ny = 0; ny < nImageLength; ++ny) { - for ( np = 0; np < nPlanes; np++ ) + for (sal_uLong np = 0; np < nPlanes; ++np) { if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip ) { @@ -656,7 +664,7 @@ bool TIFFReader::ReadMap() } else if ( nCompression == 32773 ) { - sal_uLong nStrip,nRecCount,np,i; + sal_uLong nStrip,nRecCount,i; sal_uInt8 * pdst; nStrip = 0; if ( nStrip >= nNumStripOffsets ) @@ -664,7 +672,7 @@ bool TIFFReader::ReadMap() pTIFF->Seek(pStripOffsets[nStrip]); for (sal_Int32 ny = 0; ny < nImageLength; ++ny) { - for ( np = 0; np < nPlanes; np++ ) + for (sal_uLong np = 0; np < nPlanes; ++np) { if ( ny / GetRowsPerStrip() + np * nStripsPerPlane > nStrip ) { @@ -1178,6 +1186,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) pTIFF = &rTIFF; nMaxPos = nOrigPos = pTIFF->Tell(); + nEndOfFile = nOrigPos + pTIFF->remainingSize(); // number format of pTIFF at the beginning SvStreamEndian nOrigNumberFormat = pTIFF->GetEndian(); commit a3cc2d8d598922b5dacd84721c05e73e435e999e Author: Caolán McNamara <[email protected]> Date: Mon Jul 20 12:28:53 2015 +0100 cppcheck: noExplicitConstructor Change-Id: I6f25d8cf14e3e12eecb29eb02e018ecfa73539dd diff --git a/dbaccess/source/ui/app/AppController.hxx b/dbaccess/source/ui/app/AppController.hxx index b808254..7e4c664 100644 --- a/dbaccess/source/ui/app/AppController.hxx +++ b/dbaccess/source/ui/app/AppController.hxx @@ -415,7 +415,7 @@ namespace dbaui virtual ~OApplicationController(); public: - OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB); + explicit OApplicationController(const css::uno::Reference< css::uno::XComponentContext >& _rxORB); DECLARE_XINTERFACE( ) DECLARE_XTYPEPROVIDER( ) diff --git a/dbaccess/source/ui/app/AppDetailView.hxx b/dbaccess/source/ui/app/AppDetailView.hxx index a429ff5..6405dc1 100644 --- a/dbaccess/source/ui/app/AppDetailView.hxx +++ b/dbaccess/source/ui/app/AppDetailView.hxx @@ -55,7 +55,7 @@ namespace dbaui vcl::Font m_aOriginalFont; public: - OCreationList( OTasksWindow& _rParent ); + explicit OCreationList( OTasksWindow& _rParent ); // Window overrides virtual void MouseMove( const MouseEvent& rMEvt ) SAL_OVERRIDE; virtual void MouseButtonDown( const MouseEvent& rMEvt ) SAL_OVERRIDE; diff --git a/dbaccess/source/ui/app/AppIconControl.hxx b/dbaccess/source/ui/app/AppIconControl.hxx index 10c425b..54a9c1a 100644 --- a/dbaccess/source/ui/app/AppIconControl.hxx +++ b/dbaccess/source/ui/app/AppIconControl.hxx @@ -32,7 +32,7 @@ namespace dbaui IControlActionListener* m_pActionListener; public: - OApplicationIconControl(vcl::Window* _pParent); + explicit OApplicationIconControl(vcl::Window* _pParent); virtual ~OApplicationIconControl(); virtual void dispose() SAL_OVERRIDE;
_______________________________________________ Libreoffice-commits mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
