[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/filter/png/PngImageReader.cxx |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit b7b83a5de26567c2f6b482b16c4adf3e4f391ca2
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Jun 12 10:46:24 2023 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Mon Jun 12 13:23:03 2023 +0200

    ofz#59762 Out-of-memory
    
    this one is a writable SvMemoryStream so Seek(Rel) will attempt to resize
    if the destination is outside the current size
    
    Change-Id: I1f29531979ced103c51bd423ea0d5665f2b5bdb6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152895
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/vcl/source/filter/png/PngImageReader.cxx 
b/vcl/source/filter/png/PngImageReader.cxx
index af74099a3039..d560736e686a 100644
--- a/vcl/source/filter/png/PngImageReader.cxx
+++ b/vcl/source/filter/png/PngImageReader.cxx
@@ -874,7 +874,7 @@ bool PngImageReader::isAPng(SvStream& rStream)
     sal_uInt32 nChunkSize, nChunkType;
     rStream.ReadUInt32(nChunkSize);
     rStream.ReadUInt32(nChunkType);
-    if (nChunkType != PNG_IHDR_SIGNATURE)
+    if (!rStream.good() || nChunkType != PNG_IHDR_SIGNATURE)
         return false;
     rStream.SeekRel(nChunkSize);
     // Skip IHDR CRC
@@ -895,8 +895,8 @@ bool PngImageReader::isAPng(SvStream& rStream)
             return true;
         else
         {
-            rStream.SeekRel(nChunkSize);
-            rStream.SeekRel(PNG_CRC_SIZE);
+            if (!checkSeek(rStream, rStream.Tell() + nChunkSize + 
PNG_CRC_SIZE))
+                return false;
         }
     }
 }