filter/source/graphicfilter/itiff/itiff.cxx | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
New commits: commit 663702cd3e8dc6967d8a6762ae534e06dc7d502b Author: Caolán McNamara <caol...@redhat.com> Date: Mon Feb 26 10:11:57 2018 +0000 ofz#6561 sanitize palette index Change-Id: I78cc6a7eab114fdbcc438385706d56cd48a4f1fc Reviewed-on: https://gerrit.libreoffice.org/50351 Tested-by: Jenkins <c...@libreoffice.org> Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index e19d6b2d5f9c..5fa3ae7eb796 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1205,6 +1205,23 @@ bool TIFFReader::HasAlphaChannel() const ); } +namespace +{ + Color SanitizePaletteIndex(sal_uInt8 nIndex, const std::vector<Color>& rPalette) + { + const size_t nPaletteEntryCount = rPalette.size(); + if (nPaletteEntryCount && nIndex >= nPaletteEntryCount) + { + auto nSanitizedIndex = nIndex % nPaletteEntryCount; + SAL_WARN_IF(nIndex != nSanitizedIndex, "vcl", "invalid colormap index: " + << static_cast<unsigned int>(nIndex) << ", colormap len is: " + << nPaletteEntryCount); + nIndex = nSanitizedIndex; + } + + return rPalette[nIndex]; + } +} bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) { @@ -1548,7 +1565,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) for (sal_Int32 nX = 0; nX < nImageWidth; ++nX) { auto p = maBitmap.data() + ((maBitmapPixelSize.Width() * nY + nX) * 3); - auto c = mvPalette[*p]; + auto c = SanitizePaletteIndex(*p, mvPalette); *p = c.GetRed(); p++; *p = c.GetGreen(); _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits