commit 0f0f02d633e2f9e69220d3d47de17b9e34b00765
author Caolán McNamara <caolanm@redhat.com> Wed Feb 08 14:23:27 2017 +0000
committer Caolán McNamara <caolanm@redhat.com> Thu Mar 09 21:12:38 2017 +0000
tree a551f64c5d1a50fba21c6c7f85a5937eba3845ba
parent 3e23beda17b12e35da3be3ca65f0c3d41c60d79d

ofz#574 sanitize png palette indexes

Change-Id: I006ffdf5c8c751e7e07b133716022e2a9b154478
Reviewed-on: https://gerrit.libreoffice.org/34034
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

vcl/source/gdi/pngread.cxx

diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index bea6e07..6cf9828 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -1114,6 +1114,19 @@ void PNGReaderImpl::ImplApplyFilter()

namespace
{
    sal_uInt8 SanitizePaletteIndex(sal_uInt8 nIndex, sal_uInt16 nPaletteEntryCount)
    {
        if (nIndex >= nPaletteEntryCount)
        {
            auto nSanitizedIndex = nIndex % nPaletteEntryCount;
            SAL_WARN_IF(nIndex != nSanitizedIndex, "vcl", "invalid colormap index: "
                        << static_cast<unsigned int>(nIndex) << ", colormap len is: "
                        << nPaletteEntryCount);
            nIndex = nSanitizedIndex;
        }
        return nIndex;
    }

    void SanitizePaletteIndexes(sal_uInt8* pEntries, int nLen, const Bitmap::ScopedWriteAccess& rAcc)
    {
        sal_uInt16 nPaletteEntryCount = rAcc->GetPaletteEntryCount();
@@ -1602,7 +1615,7 @@ void PNGReaderImpl::ImplSetPixel( sal_uInt32 nY, sal_uInt32 nX, sal_uInt8 nPalIn
        return;
    nX >>= mnPreviewShift;

    mxAcc->SetPixelIndex( nY, nX, nPalIndex );
    mxAcc->SetPixelIndex(nY, nX, SanitizePaletteIndex(nPalIndex, mxAcc->GetPaletteEntryCount()));
}

void PNGReaderImpl::ImplSetTranspPixel( sal_uInt32 nY, sal_uInt32 nX, const BitmapColor& rBitmapColor, bool bTrans )
@@ -1628,7 +1641,7 @@ void PNGReaderImpl::ImplSetAlphaPixel( sal_uInt32 nY, sal_uInt32 nX,
        return;
    nX >>= mnPreviewShift;

    mxAcc->SetPixelIndex( nY, nX, nPalIndex );
    mxAcc->SetPixelIndex(nY, nX, SanitizePaletteIndex(nPalIndex, mxAcc->GetPaletteEntryCount()));
    mpMaskAcc->SetPixel(nY, nX, BitmapColor(~nAlpha));
}