vcl/source/filter/itiff/itiff.cxx |   49 +++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 26 deletions(-)

New commits:
commit ee3d15ef630c5875a573318bad5cbd0a81ef71db
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Nov 21 20:44:53 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Nov 22 09:38:56 2022 +0100

    ofz#53401 Timeout
    
    Change-Id: I929006b2b993fde110fb4d7d72fd6b1e6c146066
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143075
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index ed74d00ddeb9..a611810a9aec 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -166,43 +166,40 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
                 break;
             }
 
-            uint16_t PhotometricInterpretation;
-            if (TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, 
&PhotometricInterpretation) == 1)
+            if (TIFFIsTiled(tif))
             {
-                if (PhotometricInterpretation == PHOTOMETRIC_LOGL)
+                uint32_t tw, th;
+                TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
+                TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
+
+                if (tw > w || th > h)
+                {
+                    bOk = th < 1000 * tw && tw < 1000 * th;
+                    SAL_WARN_IF(!bOk, "filter.tiff", "skipping slow bizarre 
ratio tile of " << tw << " x " << th << " for image of " << w << " x " << h);
+                }
+
+                uint16_t PhotometricInterpretation;
+                if (TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, 
&PhotometricInterpretation) == 1)
                 {
-                    if (TIFFIsTiled(tif))
+                    if (PhotometricInterpretation == PHOTOMETRIC_LOGL)
                     {
-                        uint32_t tw, th;
-                        if (TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw) == 1 &&
-                            TIFFGetField(tif, TIFFTAG_TILELENGTH, &th) == 1)
-                        {
-                            uint32_t nLogLBufferRequired;
-                            bOk = !o3tl::checked_multiply(tw, th, 
nLogLBufferRequired) && nLogLBufferRequired < MAX_PIXEL_SIZE;
-                            SAL_WARN_IF(!bOk, "filter.tiff", "skipping 
oversized tiff tile " << tw << " x " << th);
-                        }
+                        uint32_t nLogLBufferRequired;
+                        bOk &= !o3tl::checked_multiply(tw, th, 
nLogLBufferRequired) && nLogLBufferRequired < MAX_PIXEL_SIZE;
+                        SAL_WARN_IF(!bOk, "filter.tiff", "skipping oversized 
tiff tile " << tw << " x " << th);
                     }
                 }
-            }
 
-            uint16_t Compression;
-            if (TIFFGetField(tif, TIFFTAG_COMPRESSION, &Compression) == 1)
-            {
-                if (Compression == COMPRESSION_CCITTFAX4)
+                uint16_t Compression;
+                if (TIFFGetField(tif, TIFFTAG_COMPRESSION, &Compression) == 1)
                 {
-                    if (TIFFIsTiled(tif))
+                    if (Compression == COMPRESSION_CCITTFAX4)
                     {
-                        uint32_t tw;
-                        if (TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw) == 1)
-                        {
-                            uint32_t DspRuns;
-                            bOk = !o3tl::checked_multiply(tw, 
static_cast<uint32_t>(4), DspRuns) && DspRuns < MAX_PIXEL_SIZE;
-                            SAL_WARN_IF(!bOk, "filter.tiff", "skipping 
oversized tiff tile width: " << tw);
-                        }
+                        uint32_t DspRuns;
+                        bOk &= !o3tl::checked_multiply(tw, 
static_cast<uint32_t>(4), DspRuns) && DspRuns < MAX_PIXEL_SIZE;
+                        SAL_WARN_IF(!bOk, "filter.tiff", "skipping oversized 
tiff tile width: " << tw);
                     }
                 }
             }
-
         }
 
         if (!bOk)

Reply via email to