From 4091841023c745edcd696af06a872c1affd6e36d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Thu, 31 Aug 2017 10:49:01 +0100
Subject: [PATCH] ofz#3240: avoid oom in gif loader
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ifd00962ed607166b5521a3977a3021fb7b24957e
Reviewed-on: https://gerrit.libreoffice.org/41747
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 .../graphicfilter/data/gif/fail/too-small-1.gif  | Bin 0 -> 3080 bytes
 vcl/source/filter/igif/gifread.cxx               |  13 ++++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif b/vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif
new file mode 100644
index 0000000000000000000000000000000000000000..26b35e63b2eb3ab53d592bc5f8bf37ec451ea536
GIT binary patch
literal 3080
zcmZ?wbh9u|RDb{-FlEieq`<&HDLc^(Xbuz597Uk{qwLXe7@TQfG>ML8&(Sn6ng&MG
dz-Ss6O#`E8fXp<&#V|OVHw-$2+uq<F000^OqJ97X

literal 0
HcmV?d00001

diff --git a/vcl/source/filter/igif/gifread.cxx b/vcl/source/filter/igif/gifread.cxx
index ef2cb32ed7fe..9d07b805417d 100644
--- a/vcl/source/filter/igif/gifread.cxx
+++ b/vcl/source/filter/igif/gifread.cxx
@@ -175,12 +175,19 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal,
     // so assume compression of 1:2560 is possible
     // (http://cloudinary.com/blog/a_one_color_image_is_worth_two_thousand_words suggests
     // 1:1472.88 [184.11 x 8] is more realistic)
-    const sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
+
+    sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
+    for (size_t i = 0; i < aAnimation.Count(); ++i)
+    {
+        const Size& rSize = aAnimation.Get(i).aSizePix;
+        nMinFileData += rSize.Width() * rSize.Height() / 2560;
+    }
+
     if (nMaxStreamData < nMinFileData)
     {
         //there is nowhere near enough data in this stream to fill the claimed dimensions
-        SAL_WARN("vcl.filter", "gif claims dimensions " << nWidth << " x " << nHeight <<
-                               " but filesize of " << nMaxStreamData << " is surely insufficiently large to fill it");
+        SAL_WARN("vcl.filter", "in gif frame index " << aAnimation.Count() << " gif claims dimensions " << nWidth << " x " << nHeight <<
+                               " but filesize of " << nMaxStreamData << " is surely insufficiently large to fill all frame images");
         bStatus = false;
         return;
     }