vcl/source/gdi/dibtools.cxx |   33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

New commits:
commit 9d2c6fc2f0bd79ae5dbe3ca5d0bb34aeecfb1efd
Author:     Andras Timar <andras.ti...@collabora.com>
AuthorDate: Thu Jan 6 23:01:29 2022 +0100
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Fri Jan 7 08:25:16 2022 +0100

    Backport the better fix of tdf#73523 from master
    
    Change-Id: Ica2cfea7d91bc4f30f83ec74064895d707ab9882
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128088
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index 949423a1f255..6a64f60549fa 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -249,8 +249,18 @@ bool ImplReadDIBInfoHeader(SvStream& rIStm, DIBV5Header& 
rHeader, bool& bTopDown
         readUInt32( rHeader.nV5ProfileSize );
         readUInt32( rHeader.nV5Reserved );
 
+        // Read color mask. An additional 12 bytes of color bitfields follow 
the info header (WinBMPv3-NT)
+        sal_uInt32 nColorMask = 0;
+        if (BITFIELDS == rHeader.nCompression && DIBINFOHEADERSIZE == 
rHeader.nSize)
+        {
+            rIStm.ReadUInt32( rHeader.nV5RedMask );
+            rIStm.ReadUInt32( rHeader.nV5GreenMask );
+            rIStm.ReadUInt32( rHeader.nV5BlueMask );
+            nColorMask = 12;
+        }
+
         // seek to EndPos
-        if (!checkSeek(rIStm, aStartPos + rHeader.nSize))
+        if (!checkSeek(rIStm, aStartPos + rHeader.nSize + nColorMask))
             return false;
     }
 
@@ -533,13 +543,12 @@ bool ImplReadDIBBits(SvStream& rIStm, DIBV5Header& 
rHeader, BitmapWriteAccess& r
     }
     else
     {
-        // Read color mask. An additional 12 bytes of color bitfields follow 
the info header (WinBMPv3-NT)
-        if(bTCMask && BITFIELDS == rHeader.nCompression && DIBINFOHEADERSIZE 
== rHeader.nSize)
-        {
-            rIStm.ReadUInt32( nRMask );
-            rIStm.ReadUInt32( nGMask );
-            rIStm.ReadUInt32( nBMask );
-        }
+        if (rHeader.nV5RedMask > 0)
+            nRMask = rHeader.nV5RedMask;
+        if (rHeader.nV5GreenMask > 0)
+            nGMask = rHeader.nV5GreenMask;
+        if (rHeader.nV5BlueMask > 0)
+            nBMask = rHeader.nV5BlueMask;
 
         const long nWidth(rHeader.nWidth);
         const long nHeight(rHeader.nHeight);
@@ -910,7 +919,13 @@ bool ImplReadDIBBody(SvStream& rIStm, Bitmap& rBmp, 
AlphaMask* pBmpAlpha, sal_uL
 
     if (nOffset)
     {
-        pIStm->SeekRel(nOffset - (pIStm->Tell() - nStmPos));
+        // It is problematic to seek backwards. We are at the
+        // end of BITMAPINFOHEADER or 12 bytes further in case
+        // of WinBMPv3-NT format. It is possible to seek forward
+        // though because a gap may be there.
+        sal_Int32 nSeekRel = nOffset - (pIStm->Tell() - nStmPos);
+        if (nSeekRel > 0)
+            pIStm->SeekRel(nSeekRel);
     }
 
     const sal_Int64 nBitsPerLine (static_cast<sal_Int64>(aHeader.nWidth) * 
static_cast<sal_Int64>(aHeader.nBitCount));

Reply via email to