diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-08-17 16:14:16 +0100 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2014-08-18 01:24:48 -0500 |
| commit | 55fd7b2d236dc6dc09676b7dce60dc4e2e1786fc (patch) | |
| tree | fda7c1bf4c5a9aafdef5eda0b563dce8a085c77b /vcl | |
| parent | check TRG_HasMasterPage before TRG_GetMasterPage (diff) | |
| download | core-55fd7b2d236dc6dc09676b7dce60dc4e2e1786fc.tar.gz core-55fd7b2d236dc6dc09676b7dce60dc4e2e1786fc.zip | |
check that AddToTable can be done validly
Change-Id: I0ee69279e3bb1d9871feba17b908b8307f0ec5b4
(cherry picked from commit 43b39d3e47ffd179071732c0a8fc201c31b2bb46)
Reviewed-on: https://gerrit.libreoffice.org/10949
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/filter/igif/decode.cxx | 24 | ||||
| -rw-r--r-- | vcl/source/filter/igif/decode.hxx | 2 |
2 files changed, 19 insertions, 7 deletions
diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx index 85b417cb62f2..d50ac7c3bd15 100644 --- a/vcl/source/filter/igif/decode.cxx +++ b/vcl/source/filter/igif/decode.cxx @@ -47,12 +47,14 @@ GIFLZWDecompressor::GIFLZWDecompressor(sal_uInt8 cDataSize) pTable = new GIFLZWTableEntry[ 4098 ]; - for( sal_uInt16 i = 0; i < nTableSize; i++ ) + for (sal_uInt16 i = 0; i < nTableSize; ++i) { pTable[i].pPrev = NULL; pTable[i].pFirst = pTable + i; pTable[i].nData = (sal_uInt8) i; } + + memset(pTable + nTableSize, 0, sizeof(GIFLZWTableEntry) * (4098 - nTableSize)); } GIFLZWDecompressor::~GIFLZWDecompressor() @@ -105,7 +107,7 @@ HPBYTE GIFLZWDecompressor::DecompressBlock( HPBYTE pSrc, sal_uInt8 cBufSize, return pTarget; } -void GIFLZWDecompressor::AddToTable( sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData ) +bool GIFLZWDecompressor::AddToTable( sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData ) { GIFLZWTableEntry* pE; @@ -114,12 +116,16 @@ void GIFLZWDecompressor::AddToTable( sal_uInt16 nPrevCode, sal_uInt16 nCodeFirst pE = pTable + nTableSize; pE->pPrev = pTable + nPrevCode; pE->pFirst = pE->pPrev->pFirst; - pE->nData = pTable[ nCodeFirstData ].pFirst->nData; + GIFLZWTableEntry *pEntry = pTable[nCodeFirstData].pFirst; + if (!pEntry) + return false; + pE->nData = pEntry->nData; nTableSize++; if ( ( nTableSize == (sal_uInt16) (1 << nCodeSize) ) && ( nTableSize < 4096 ) ) nCodeSize++; } + return true; } bool GIFLZWDecompressor::ProcessOneCode() @@ -151,17 +157,23 @@ bool GIFLZWDecompressor::ProcessOneCode() if ( nCode < nClearCode ) { + bool bOk = true; if ( nOldCode != 0xffff ) - AddToTable( nOldCode, nCode ); + bOk = AddToTable(nOldCode, nCode); + if (!bOk) + return false; } else if ( ( nCode > nEOICode ) && ( nCode <= nTableSize ) ) { if ( nOldCode != 0xffff ) { + bool bOk; if ( nCode == nTableSize ) - AddToTable( nOldCode, nOldCode ); + bOk = AddToTable( nOldCode, nOldCode ); else - AddToTable( nOldCode, nCode ); + bOk = AddToTable( nOldCode, nCode ); + if (!bOk) + return false; } } else diff --git a/vcl/source/filter/igif/decode.hxx b/vcl/source/filter/igif/decode.hxx index 542532673359..ee093bfaa2c5 100644 --- a/vcl/source/filter/igif/decode.hxx +++ b/vcl/source/filter/igif/decode.hxx @@ -43,7 +43,7 @@ class GIFLZWDecompressor sal_uInt8 nBlockBufSize; sal_uInt8 nBlockBufPos; - void AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData); + bool AddToTable(sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData); bool ProcessOneCode(); public: |