ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#559994947 Out-of-memory

Browse Source 
the tile data of a tiled PixarLog tiff was truncated, but we zero
fill one short read, so libtiff sized its decode buffer from the
strip geometry and asked for 34GB

the old parser didn't handle tiled images, so don't allow the short
read for them, and cap any single libtiff allocation at the largest
strip we accept

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Iebcfa801a20e017c84d0af855e13b22535b362eb
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12360
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit cff709c8107b8ab6b544cf8130ec7a8185501ea5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211409
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-09-24 11:01:15 +02:00
committed by Xisco Fauli
parent 99e022072c
commit 8bcb8dc7a9
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vcl/source/filter/itiff/itiff.cxx
+14 -3
View File
@@ -132,10 +132,19 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic)
});
Context aContext(rTIFF);
TIFF* tif = TIFFClientOpen("libtiff-svstream", "r", &aContext,
TIFFOpenOptions* pOptions = TIFFOpenOptionsAlloc();
if (pOptions)
{
// Matches the largest strip accepted below, so a geometry that needs more than that
// fails inside libtiff rather than asking the system for the memory.
TIFFOpenOptionsSetMaxSingleMemAlloc(pOptions, SAL_MAX_INT32);
}
TIFF* tif = TIFFClientOpenExt("libtiff-svstream", "r", &aContext,
tiff_read, tiff_write,
tiff_seek, tiff_close,
tiff_size, nullptr, nullptr);
tiff_size, nullptr, nullptr, pOptions);
TIFFOpenOptionsFree(pOptions);
if (!tif)
return false;
@@ -242,8 +251,10 @@ bool ImportTiffGraphicImport(SvStream& rTIFF, Graphic& rGraphic)
// parser that this replaced. But don't allow that for:
// a) new compression variations that the old parser didn't handle
// b) complicated pixel layout variations that the old parser didn't handle
// c) tiled images, which the old parser didn't handle
// so we don't take libtiff into uncharted territory.
aContext.bAllowOneShortRead = !bNewCodec && PhotometricInterpretation != PHOTOMETRIC_YCBCR;
aContext.bAllowOneShortRead = !bNewCodec && PhotometricInterpretation != PHOTOMETRIC_YCBCR
&& !TIFFIsTiled(tif);
if (TIFFReadRGBAImageOriented(tif, w, h, raster.data(), ORIENTATION_TOPLEFT, 1))
{