filter/source/graphicfilter/itiff/itiff.cxx | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit 49d17d392b7c7a309b3d9264643881656d386eb1
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Jul 21 19:55:29 2019 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Jul 21 22:32:46 2019 +0200
ofz#15993 Timeout
massive nSamplesPerPixel value, tiff spec says samples-per-pixel is
supposed to be SHORT so don't accept beyond that as legal
Change-Id: I3e6d3550e3b07a8d27ec4d72ecc4549dd52e50bc
Reviewed-on: https://gerrit.libreoffice.org/76075
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx
b/filter/source/graphicfilter/itiff/itiff.cxx
index 970e5958635f..15a4fe3d3b43 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -427,6 +427,10 @@ void TIFFReader::ReadTagData( sal_uInt16 nTagType,
sal_uInt32 nDataLen)
case 0x0115: // Samples Per Pixel
nSamplesPerPixel = ReadIntData();
SAL_INFO("filter.tiff","SamplesPerPixel: " << nSamplesPerPixel);
+
+ if (nSamplesPerPixel > USHRT_MAX) // ofz#15993 the expected type
is SHORT
+ bStatus = false;
+
break;
case 0x0116: // Rows Per Strip
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
