[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/itiff/itiff.cxx |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 3b5f43a82309007cddec8a953cfb46b5ea1f3c9d
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jun 3 15:53:24 2022 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Fri Jun 3 20:48:12 2022 +0200

    ofz#47781 Out of memory
    
    Change-Id: I6ebd284bb3fa2c220b6a09fa9875b97c79f4a239
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135364
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index 1a7e48d1a3e9..74c0b55b1b59 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -150,7 +150,9 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& 
rGraphic)
         }
 
         uint32_t nPixelsRequired;
-        bool bOk = !o3tl::checked_multiply(w, h, nPixelsRequired) && 
nPixelsRequired <= SAL_MAX_INT32/4;
+        constexpr size_t nMaxPixelsAllowed = SAL_MAX_INT32/4;
+        // two buffers currently required, so limit further
+        bool bOk = !o3tl::checked_multiply(w, h, nPixelsRequired) && 
nPixelsRequired <= nMaxPixelsAllowed / 2;
         if (!bOk)
         {
             SAL_WARN("filter.tiff", "skipping oversized tiff image " << w << " 
x " << h);