From 8bcb8dc7a915d79f9ffba49755fb5316b221824d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Sun, 13 Sep 2026 16:25:30 +0000 Subject: [PATCH] ofz#559994947 Out-of-memory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit the tile data of a tiled PixarLog tiff was truncated, but we zero fill one short read, so libtiff sized its decode buffer from the strip geometry and asked for 34GB the old parser didn't handle tiled images, so don't allow the short read for them, and cap any single libtiff allocation at the largest strip we accept Signed-off-by: Caolán McNamara Change-Id: Iebcfa801a20e017c84d0af855e13b22535b362eb Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12360 Reviewed-by: Noel Grandin Tested-by: Jenkins CPCI (cherry picked from commit cff709c8107b8ab6b544cf8130ec7a8185501ea5) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211409 Tested-by: Jenkins Reviewed-by: Xisco Fauli --- vcl/source/filter/itiff/itiff.cxx | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/vcl/source/filter/itiff/itiff.cxx b/vcl/source/filter/itiff/itiff.cxx index 5b4fd134b191..04be6c8b2fce 100644 --- a/vcl/source/filter/itiff/itiff.cxx +++ b/vcl/source/filter/itiff/itiff.cxx @@ -132,10 +132,19 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) }); Context aContext(rTIFF); - TIFF* tif = TIFFClientOpen("libtiff-svstream", "r", &aContext, - tiff_read, tiff_write, - tiff_seek, tiff_close, - tiff_size, nullptr, nullptr); + + TIFFOpenOptions* pOptions = TIFFOpenOptionsAlloc(); + if (pOptions) + { + // Matches the largest strip accepted below, so a geometry that needs more than that + // fails inside libtiff rather than asking the system for the memory. + TIFFOpenOptionsSetMaxSingleMemAlloc(pOptions, SAL_MAX_INT32); + } + TIFF* tif = TIFFClientOpenExt("libtiff-svstream", "r", &aContext, + tiff_read, tiff_write, + tiff_seek, tiff_close, + tiff_size, nullptr, nullptr, pOptions); + TIFFOpenOptionsFree(pOptions); if (!tif) return false; @@ -242,8 +251,10 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic) // parser that this replaced. But don't allow that for: // a) new compression variations that the old parser didn't handle // b) complicated pixel layout variations that the old parser didn't handle + // c) tiled images, which the old parser didn't handle // so we don't take libtiff into uncharted territory. - aContext.bAllowOneShortRead = !bNewCodec && PhotometricInterpretation != PHOTOMETRIC_YCBCR; + aContext.bAllowOneShortRead = !bNewCodec && PhotometricInterpretation != PHOTOMETRIC_YCBCR + && !TIFFIsTiled(tif); if (TIFFReadRGBAImageOriented(tif, w, h, raster.data(), ORIENTATION_TOPLEFT, 1)) {