filter/source/graphicfilter/itiff/ccidecom.cxx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
New commits: commit 138737f26407acfd6cf431e4a8745569fb786dec Author: Caolán McNamara <[email protected]> Date: Tue Feb 28 16:43:44 2017 +0000 ofz#668: check nTargetBits size Change-Id: I5cc7499cfdee58ffa480bb31dfc262d5b781180d (cherry picked from commit 99c361be16eb3a21aa679a103db2d07ecd0f5d3c) Reviewed-on: https://gerrit.libreoffice.org/34723 Tested-by: Jenkins <[email protected]> Reviewed-by: Markus Mohrhard <[email protected]> diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx b/filter/source/graphicfilter/itiff/ccidecom.cxx index 1cb7d7d..4fcb6b9 100644 --- a/filter/source/graphicfilter/itiff/ccidecom.cxx +++ b/filter/source/graphicfilter/itiff/ccidecom.cxx @@ -627,7 +627,9 @@ void CCIDecompressor::StartDecompression( SvStream & rIStream ) bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTargetBits, bool bLastLine ) { - bool b2D; + //Read[1|2]DScanlineData take a sal_uInt16, so its either limit here or expand there + if (nTargetBits > SAL_MAX_UINT16) + return false; if ( nEOLCount >= 5 ) // RTC (Return To Controller) return true; @@ -682,6 +684,7 @@ bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong nTarget if ( nOptions & CCI_OPTION_BYTEALIGNROW ) nInputBitsBufSize &= 0xfff8; + bool b2D; // is it a 2D row? if ( nOptions & CCI_OPTION_2D ) {
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
