commit 38bf835b48efa2e32d917538cabc4fa2e1dec56d
author Caolán McNamara <caolanm@redhat.com> Wed Jul 17 16:13:17 2019 +0100
committer Michael Stahl <Michael.Stahl@cib.de> Thu Jul 18 10:44:02 2019 +0200
tree 8d5c11ba2cb56ad7504d3247a70ee9cc11a2d46b
parent 02507a9e2bd37b5556895fc52dd94c8d17b2b770

Resolves: tdf#126147 relax sanity check and allow truncated tiffs

now the start of the row of data must still exist, but the full
length of the row doesn't have to exist

Change-Id: I5ed8ffef2cab19f040ba789a5d82560ca6847f26
Reviewed-on: https://gerrit.libreoffice.org/75795
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>

filter/source/graphicfilter/itiff/itiff.cxx

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index d2bb00e..9c22366 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -568,9 +568,11 @@ bool TIFFReader::ReadMap()
                if ( nStrip >= aStripOffsets.size())
                    return false;
                pTIFF->Seek( aStripOffsets[ nStrip ] + ( ny % GetRowsPerStrip() ) * nStripBytesPerRow );
                pTIFF->ReadBytes(getMapData(np), nBytesPerRow);
                if (!pTIFF->good())
                    return false;
                // tdf#126147 allow a short incomplete read
                auto pDest = getMapData(np);
                auto nRead = pTIFF->ReadBytes(pDest, nBytesPerRow);
                if (nRead != nBytesPerRow)
                    memset(pDest + nRead, 0, nBytesPerRow - nRead);
            }
            if ( !ConvertScanline( ny ) )
                return false;
@@ -1510,8 +1512,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
                    if (bStatus)
                    {
                        auto nStart = aStripOffsets[ nStrip ] + ( ny % GetRowsPerStrip() ) * nStripBytesPerRow;
                        auto nEnd = nStart + nBytesPerRow;
                        if (nEnd > nEndOfFile)
                        if (nStart > nEndOfFile)
                            bStatus = false;
                    }
                }