1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
--- goodies/source/filter.vcl/itiff/itiff.cxx-old 2007-06-21 14:17:54.000000000 +0100
+++ goodies/source/filter.vcl/itiff/itiff.cxx 2007-06-21 14:18:01.000000000 +0100
@@ -154,7 +154,7 @@
double ReadDoubleData();
void ReadHeader();
- void ReadTagData( USHORT nTagType, ULONG nDataLen );
+ void ReadTagData( USHORT nTagType, sal_uInt32 nDataLen );
BOOL ReadMap( ULONG nMinPercent, ULONG nMaxPercent );
// Liesst/dekomprimert die Bitmap-Daten, und fuellt pMap
@@ -310,7 +310,7 @@
// ---------------------------------------------------------------------------------
-void TIFFReader::ReadTagData( USHORT nTagType, ULONG nDataLen)
+void TIFFReader::ReadTagData( USHORT nTagType, sal_uInt32 nDataLen)
{
if ( bStatus == FALSE )
return;
@@ -373,16 +373,25 @@
case 0x0111: { // Strip Offset(s)
ULONG nOldNumSO, i, * pOldSO;
pOldSO = pStripOffsets;
- if ( pOldSO == NULL ) nNumStripOffsets = 0; // Sicherheitshalber
+ if ( pOldSO == NULL )
+ nNumStripOffsets = 0;
nOldNumSO = nNumStripOffsets;
- nNumStripOffsets += nDataLen;
- pStripOffsets = new ULONG[ nNumStripOffsets ];
- for ( i = 0; i < nOldNumSO; i++ )
- pStripOffsets[ i ] = pOldSO[ i ] + nOrigPos;
- for ( i = nOldNumSO; i < nNumStripOffsets; i++ )
- pStripOffsets[ i ] = ReadIntData() + nOrigPos;
- if ( pOldSO != NULL )
+ nDataLen += nOldNumSO;
+ if ( ( nDataLen > nOldNumSO ) && ( nDataLen < SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) )
+ {
+ nNumStripOffsets = nDataLen;
+ pStripOffsets = new ULONG[ nNumStripOffsets ];
+ if ( !pStripOffsets )
+ nNumStripOffsets = 0;
+ else
+ {
+ for ( i = 0; i < nOldNumSO; i++ )
+ pStripOffsets[ i ] = pOldSO[ i ] + nOrigPos;
+ for ( i = nOldNumSO; i < nNumStripOffsets; i++ )
+ pStripOffsets[ i ] = ReadIntData() + nOrigPos;
+ }
delete[] pOldSO;
+ }
OOODEBUG("StripOffsets (Anzahl:)",nDataLen);
break;
}
@@ -404,16 +413,25 @@
case 0x0117: { // Strip Byte Counts
ULONG nOldNumSBC, i, * pOldSBC;
pOldSBC = pStripByteCounts;
- if ( pOldSBC == NULL ) nNumStripByteCounts = 0; // Sicherheitshalber
+ if ( pOldSBC == NULL )
+ nNumStripByteCounts = 0; // Sicherheitshalber
nOldNumSBC = nNumStripByteCounts;
- nNumStripByteCounts += nDataLen;
- pStripByteCounts = new ULONG[ nNumStripByteCounts ];
- for ( i = 0; i < nOldNumSBC; i++ )
- pStripByteCounts[ i ] = pOldSBC[ i ];
- for ( i = nOldNumSBC; i < nNumStripByteCounts; i++)
- pStripByteCounts[ i ] = ReadIntData();
- if ( pOldSBC != NULL )
+ nDataLen += nOldNumSBC;
+ if ( ( nDataLen > nOldNumSBC ) && ( nDataLen < SAL_MAX_UINT32 / sizeof( sal_uInt32 ) ) )
+ {
+ nNumStripByteCounts = nDataLen;
+ pStripByteCounts = new ULONG[ nNumStripByteCounts ];
+ if ( !nNumStripByteCounts )
+ nNumStripByteCounts = 0;
+ else
+ {
+ for ( i = 0; i < nOldNumSBC; i++ )
+ pStripByteCounts[ i ] = pOldSBC[ i ];
+ for ( i = nOldNumSBC; i < nNumStripByteCounts; i++)
+ pStripByteCounts[ i ] = ReadIntData();
+ }
delete[] pOldSBC;
+ }
OOODEBUG("StripByteCounts (Anzahl:)",nDataLen);
break;
}
|
GitWeb