Kaydet (Commit) cdb14f5b authored tarafından osnola's avatar osnola Kaydeden (comit) Caolán McNamara

tdf92789 fix reading of some PICT images

(cherry picked from commit 5fa73031)

Conflicts:
	filter/source/graphicfilter/ipict/ipict.cxx

add a test image

(cherry picked from commit 3f0677b8)

Change-Id: I6809ef52c462958eed2329fe2d32b5cbc691194c
Reviewed-on: https://gerrit.libreoffice.org/17203Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst 4b96ee2d
...@@ -879,7 +879,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -879,7 +879,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
} }
else else
{ {
nCount = static_cast<sal_uInt16>( 1 - ( ( (sal_uInt16)nFlagCounterByte ) | 0xff00 ) ); nCount = static_cast<sal_uInt16>( 1 - sal_Int16( ( (sal_uInt16)nFlagCounterByte ) | 0xff00 ) );
pPict->ReadUChar( nDat ); pPict->ReadUChar( nDat );
for ( i = 0; i < nCount; i++ ) for ( i = 0; i < nCount; i++ )
{ {
...@@ -901,21 +901,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -901,21 +901,10 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if (nWidth > nRowBytes / 2) if (nWidth > nRowBytes / 2)
BITMAPERROR; BITMAPERROR;
size_t nMinRecordSize; if ( nRowBytes < 8 || nPackType == 1 ) {
if ( nRowBytes < 8 || nPackType == 1 ) if (pPict->remainingSize() < sizeof(sal_uInt16) * nHeight * nWidth)
nMinRecordSize = sizeof(sal_uInt16); BITMAPERROR;
else if ( nRowBytes > 250 ) }
nMinRecordSize = sizeof(sal_uInt16);
else
nMinRecordSize = 1;
const size_t nMinRowWidth = nWidth * nMinRecordSize;
const size_t nMaxRows = pPict->remainingSize() / nMinRowWidth;
if (nHeight > nMaxRows)
BITMAPERROR;
const size_t nMaxCols = pPict->remainingSize() / nHeight;
if (nWidth > nMaxCols)
BITMAPERROR;
for ( ny = 0; ny < nHeight; ny++ ) for ( ny = 0; ny < nHeight; ny++ )
{ {
...@@ -952,10 +941,17 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -952,10 +941,17 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
if ( (nFlagCounterByte & 0x80) == 0) if ( (nFlagCounterByte & 0x80) == 0)
{ {
nCount=((sal_uInt16)nFlagCounterByte)+1; nCount=((sal_uInt16)nFlagCounterByte)+1;
if ( nCount + nx > nWidth) // SJ: the RLE decoding seems not to be correct here, if ( nCount + nx > nWidth)
nCount = nWidth - nx; // I don't want to change this until I have a bugdoc for nCount = nWidth - nx;
for (i=0; i<nCount; i++) // this case. Have a look at 32bit, there I changed the if (pPict->remainingSize() < sizeof(sal_uInt16) * nCount)
{ // encoding, so that it is used a straight forward array BITMAPERROR;
/* SJ: the RLE decoding seems not to be correct here,
I don't want to change this until I have a bugdoc for
this case. Have a look at 32bit, there I changed the
encoding, so that it is used a straight forward array
*/
for (i=0; i<nCount; i++)
{
pPict->ReadUInt16( nD ); pPict->ReadUInt16( nD );
nRed = (sal_uInt8)( nD >> 7 ); nRed = (sal_uInt8)( nD >> 7 );
nGreen = (sal_uInt8)( nD >> 2 ); nGreen = (sal_uInt8)( nD >> 2 );
...@@ -965,7 +961,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -965,7 +961,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
} }
else else
{ {
nCount=(1-(((sal_uInt16)nFlagCounterByte)|0xff00)); if (pPict->remainingSize() < sizeof(sal_uInt16))
BITMAPERROR;
nCount=(1-sal_Int16(((sal_uInt16)nFlagCounterByte)|0xff00));
if ( nCount + nx > nWidth ) if ( nCount + nx > nWidth )
nCount = nWidth - nx; nCount = nWidth - nx;
pPict->ReadUInt16( nD ); pPict->ReadUInt16( nD );
...@@ -1039,21 +1037,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -1039,21 +1037,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
{ {
if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) ) if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) )
{ {
size_t nMinRecordSize; std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
if (nRowBytes > 250)
nMinRecordSize = sizeof(sal_uInt16);
else
nMinRecordSize = 1;
const size_t nMinRowWidth = nWidth * nMinRecordSize;
const size_t nMaxRows = pPict->remainingSize() / nMinRowWidth;
if (nHeight > nMaxRows)
BITMAPERROR;
const size_t nMaxWidth = pPict->remainingSize() / nHeight;
if (nWidth > nMaxWidth)
BITMAPERROR;
boost::scoped_array<sal_uInt8> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
for ( ny = 0; ny < nHeight; ny++ ) for ( ny = 0; ny < nHeight; ny++ )
{ {
nSrcBitsPos = pPict->Tell(); nSrcBitsPos = pPict->Tell();
...@@ -1077,6 +1061,8 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -1077,6 +1061,8 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
nCount = ( (sal_uInt16)nFlagCounterByte ) + 1; nCount = ( (sal_uInt16)nFlagCounterByte ) + 1;
if ( ( i + nCount ) > static_cast<size_t>(nWidth) * nCmpCount ) if ( ( i + nCount ) > static_cast<size_t>(nWidth) * nCmpCount )
nCount = static_cast<size_t>(nWidth) * nCmpCount - i; nCount = static_cast<size_t>(nWidth) * nCmpCount - i;
if (pPict->remainingSize() < nCount)
BITMAPERROR;
while( nCount-- ) while( nCount-- )
{ {
pPict->ReadUChar( nDat ); pPict->ReadUChar( nDat );
...@@ -1085,7 +1071,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo ...@@ -1085,7 +1071,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
} }
else else
{ {
nCount = ( 1 - ( ( (sal_uInt16)nFlagCounterByte ) | 0xff00 ) ); if (pPict->remainingSize() < 1)
BITMAPERROR;
nCount = ( 1 - sal_Int16( ( (sal_uInt16)nFlagCounterByte ) | 0xff00 ) );
if ( ( i + nCount ) > static_cast<size_t>(nWidth) * nCmpCount) if ( ( i + nCount ) > static_cast<size_t>(nWidth) * nCmpCount)
nCount = static_cast<size_t>(nWidth) * nCmpCount - i; nCount = static_cast<size_t>(nWidth) * nCmpCount - i;
pPict->ReadUChar( nDat ); pPict->ReadUChar( nDat );
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment