filter/source/graphicfilter/itiff/itiff.cxx | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
New commits:
commit 4e1161c6cbdaf2bf0a92d3a5195ee559f2b77bed
Author: Caolán McNamara <caol...@redhat.com>
Date: Wed Feb 14 12:23:19 2018 +0000
ofz#6315 Heap-buffer-overflow
Change-Id: Ia611f65b9fb38f125c224473e584580eeff20622
Reviewed-on: https://gerrit.libreoffice.org/49716
Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx
b/filter/source/graphicfilter/itiff/itiff.cxx
index d86d2912804d..24b6c7143863 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -584,6 +584,7 @@ bool TIFFReader::ReadMap()
aCCIDecom.StartDecompression( *pTIFF );
+ const bool bHasAlphaChannel = HasAlphaChannel();
for (sal_Int32 ny = 0; ny < nImageLength; ++ny)
{
bool bDifferentToPrev = ny == 0;
@@ -617,9 +618,10 @@ bool TIFFReader::ReadMap()
//if the buffer for this line didn't change, then just copy the
//previous scanline instead of painfully decoding and setting
//each pixel one by one again
- memcpy( mpBitmap.get() + (ny * maBitmapPixelSize.Width()) * 4,
- mpBitmap.get() + ((ny-1) * maBitmapPixelSize.Width())
* 4,
- maBitmapPixelSize.Width() * 4);
+ const int nColorSize = bHasAlphaChannel ? 4 : 3;
+ memcpy( mpBitmap.get() + (ny * maBitmapPixelSize.Width()) *
nColorSize,
+ mpBitmap.get() + ((ny-1) * maBitmapPixelSize.Width())
* nColorSize,
+ maBitmapPixelSize.Width() * nColorSize);
}
else
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
