mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz#3240: avoid oom in gif loader

Browse Source 
Change-Id: Ifd00962ed607166b5521a3977a3021fb7b24957e
Reviewed-on: https://gerrit.libreoffice.org/41747
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-08-31 10:49:01 +01:00
parent 2e1cafaf66
commit 4091841023
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
vcl/qa/cppunit/graphicfilter/data/gif/fail/too-small-1.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 3.0 KiB

13
vcl/source/filter/igif/gifread.cxx
View File

@@ -175,12 +175,19 @@ void GIFReader::CreateBitmaps( long nWidth, long nHeight, BitmapPalette* pPal,
// so assume compression of 1:2560 is possible // so assume compression of 1:2560 is possible
// (http://cloudinary.com/blog/a_one_color_image_is_worth_two_thousand_words suggests // (http://cloudinary.com/blog/a_one_color_image_is_worth_two_thousand_words suggests
// 1:1472.88 [184.11 x 8] is more realistic) // 1:1472.88 [184.11 x 8] is more realistic)
const sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
sal_uInt64 nMinFileData = nWidth * nHeight / 2560;
for (size_t i = 0; i < aAnimation.Count(); ++i)
{
const Size& rSize = aAnimation.Get(i).aSizePix;
nMinFileData += rSize.Width() * rSize.Height() / 2560;
}
if (nMaxStreamData < nMinFileData) if (nMaxStreamData < nMinFileData)
{ {
//there is nowhere near enough data in this stream to fill the claimed dimensions //there is nowhere near enough data in this stream to fill the claimed dimensions
SAL_WARN("vcl.filter", "gif claims dimensions " << nWidth << " x " << nHeight << SAL_WARN("vcl.filter", "in gif frame index " << aAnimation.Count() << " gif claims dimensions " << nWidth << " x " << nHeight <<
" but filesize of " << nMaxStreamData << " is surely insufficiently large to fill it"); " but filesize of " << nMaxStreamData << " is surely insufficiently large to fill all frame images");
bStatus = false; bStatus = false;
return; return;
} }