vcl/source/filter/GraphicFormatDetector.cxx | 32 ++++++++++++++++------------
1 file changed, 19 insertions(+), 13 deletions(-)
New commits:
commit ef04435193dd01975446bfbb2f5384eab95ed898
Author: Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sat Aug 9 19:28:53 2025 +0100
Commit: Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Sat Aug 9 22:03:51 2025 +0200
cid#1660410 Overflowed constant
Change-Id: Ib1c9360df3667de3f99fde9520ee4eecc06cc502
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189275
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
diff --git a/vcl/source/filter/GraphicFormatDetector.cxx
b/vcl/source/filter/GraphicFormatDetector.cxx
index 90e5db7289bf..75d52c9c841c 100644
--- a/vcl/source/filter/GraphicFormatDetector.cxx
+++ b/vcl/source/filter/GraphicFormatDetector.cxx
@@ -725,27 +725,33 @@ bool GraphicFormatDetector::checkTIF()
if (mbExtendedInfo)
{
+ bool bOk = true;
+
sal_uInt32 nIfdOffset = 0;
// Offset of the first IFD
mrStream.ReadUInt32(nIfdOffset);
- mrStream.SeekRel(nIfdOffset - 8); // read 6 bytes until
here
+ if (nIfdOffset < 8)
+ bOk = false;
+ else
+ {
+ mrStream.SeekRel(nIfdOffset - 8); // read 6 bytes
until here
- sal_uInt16 nNumberOfTags = 0;
- mrStream.ReadUInt16(nNumberOfTags);
+ sal_uInt16 nNumberOfTags = 0;
+ mrStream.ReadUInt16(nNumberOfTags);
- bool bOk = true;
- sal_Int32 nCount = 0;
+ sal_Int32 nCount = 0;
- // read tags till we find Tag256(Width)
- mrStream.ReadUInt16(nTemp16);
- while (nTemp16 != 256 && bOk)
- {
- mrStream.SeekRel(10);
+ // read tags till we find Tag256(Width)
mrStream.ReadUInt16(nTemp16);
- nCount++;
- if (nCount > nNumberOfTags)
- bOk = false;
+ while (nTemp16 != 256 && bOk)
+ {
+ mrStream.SeekRel(10);
+ mrStream.ReadUInt16(nTemp16);
+ nCount++;
+ if (nCount > nNumberOfTags)
+ bOk = false;
+ }
}
if (bOk)
