png parsing regression test

basebmp/source/bitmapdevice.cxx

@@ -1881,8 +1881,16 @@ BitmapDeviceSharedPtr createBitmapDeviceImpl( const basegfx::B2IVector&
     // factor in bottom-up scanline order case
     nScanlineStride *= bTopDown ? 1 : -1;
 
-    const std::size_t nMemSize(
-        (nScanlineStride < 0 ? -nScanlineStride : nScanlineStride)*rSize.getY() );
+    const sal_uInt32 nWidth(nScanlineStride < 0 ? -nScanlineStride : nScanlineStride);
+    const sal_uInt32 nHeight(rSize.getY());
+
+    if (nHeight && nWidth && nWidth > SAL_MAX_INT32 / nHeight)
+    {
+        SAL_WARN( "basebmp", "suspicious massive alloc " << nWidth << " * " << nHeight);
+        return BitmapDeviceSharedPtr();
+    }
+
+    const std::size_t nMemSize(nWidth * nHeight);
 
     if( !pMem )
     {

svtools/qa/cppunit/data/png/fail/CVE-2004-0597-1.png

+#Mb}o72~X.^TwB!f1s
tga2bAHb"8|eGfS$N0nI֪
+0"JGzܢ(s?d)"GEF9~}r	
TΝp?*ck$E"X8=2T_3v#$Hh4JKi݊J&7r=u69KjWh{$
dV[Жy\%%ǾHme+
}gXI2>*ī&
)̸6pUTjODh1-<WURK591M?
+~*Nru;khX{֍Ԥ' ӏwF[KRfyO%0ihx׃wz4dT.@Xm4ipZ^yЯ`_Y?  tuw4\kdJ~mg`<2ln*
kh*nw7!YIßP+hK*Ԟ`?
\ No newline at end of file

svtools/qa/cppunit/data/png/fail/CVE-2009-1511-1.png

+#Mb}o72͐~\._舄{'p|&F/
\ No newline at end of file

svtools/qa/cppunit/filters-test.cxx

@@ -80,6 +80,10 @@ void SvtoolsFiltersTest::testCVEs()
     testDir(rtl::OUString(),
         getURLFromSrc("/svtools/qa/cppunit/data/sgv/"),
         rtl::OUString());
+
+    testDir(rtl::OUString(),
+        getURLFromSrc("/svtools/qa/cppunit/data/png/"),
+        rtl::OUString());
 }
 
 CPPUNIT_TEST_SUITE_REGISTRATION(SvtoolsFiltersTest);

vcl/source/gdi/pngread.cxx

@@ -194,6 +194,7 @@ PNGReaderImpl::PNGReaderImpl( SvStream& rPNGStream )
     mpScanCurrent   ( NULL ),
     mpColorTable    ( (sal_uInt8*) mpDefaultColorTable ),
     mnPass ( 0 ),
+    mbPalette( sal_False ),
     mbzCodecInUse   ( sal_False ),
     mbStatus( sal_True),
     mbIDAT( sal_False ),
@@ -297,7 +298,7 @@ bool PNGReaderImpl::ReadNextChunk()
             nCRC32 = rtl_crc32( nCRC32, &rChunkData.aData[ 0 ], mnChunkLen );
             maDataIter = rChunkData.aData.begin();
         }
-        sal_uInt32 nCheck;
+        sal_uInt32 nCheck(0);
         mrPNGStream >> nCheck;
         if( nCRC32 != nCheck )
             return false;
@@ -339,14 +340,23 @@ BitmapEx PNGReaderImpl::GetBitmapEx( const Size& rPreviewSizeHint )
     // reset to the first chunk
     maChunkIter = maChunkSeq.begin();
 
-    // parse the chunks
+    // first chunk must be IDHR
+    if( mbStatus && ReadNextChunk() )
+    {
+        if (mnChunkType == PNGCHUNK_IHDR)
+            mbStatus = ImplReadHeader( rPreviewSizeHint );
+        else
+            mbStatus = false;
+    }
+
+    // parse the remaining chunks
     while( mbStatus && !mbIDAT && ReadNextChunk() )
     {
         switch( mnChunkType )
         {
             case PNGCHUNK_IHDR :
             {
-                mbStatus = ImplReadHeader( rPreviewSizeHint );
+                mbStatus = false; //IHDR should only appear as the first chunk
             }
             break;
 
@@ -756,14 +766,17 @@ sal_Bool PNGReaderImpl::ImplReadTransparent()
             {
                 if ( mnChunkLen <= 256 )
                 {
+                    mbTransparent = true;
                     mpTransTab = new sal_uInt8 [ 256 ];
                     rtl_fillMemory( mpTransTab, 256, 0xff );
-                    rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
-                    maDataIter += mnChunkLen;
-                    mbTransparent = true;
-                    // need alpha transparency if not on/off masking
-                    for( int i = 0; i < mnChunkLen; ++i )
-                       bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
+                    if (mnChunkLen > 0)
+                    {
+                        rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
+                        maDataIter += mnChunkLen;
+                        // need alpha transparency if not on/off masking
+                        for( int i = 0; i < mnChunkLen; ++i )
+                           bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
+                    }
                 }
             }
             break;