From 63aef763da0714004cb7a449a29526e6060dc85e Mon Sep 17 00:00:00 2001
From: =?utf8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Sat, 13 Jun 2026 13:27:30 +0000
Subject: [PATCH] [PATCH] limit palette index
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

use the same SanitizePaletteIndex guard ipsd and iras already have.

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Iff3450ab2c3781c5181b3f28ed2a321d1e49c6ae
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4425
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit ada76821319b80671dba9908aeea8cabba5cedc0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206612
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 6bc93227e7c603d3f314202b89b6c567680e6261)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206670

Gbp-Pq: Name CVE-2026-63279.diff
---
 vcl/source/filter/ipict/ipict.cxx | 43 ++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/vcl/source/filter/ipict/ipict.cxx b/vcl/source/filter/ipict/ipict.cxx
index 2d9be6f8cd9..545dfe33364 100644
--- a/vcl/source/filter/ipict/ipict.cxx
+++ b/vcl/source/filter/ipict/ipict.cxx
@@ -268,43 +268,56 @@ public:
 
 }
 
+static const Color& SanitizePaletteIndex(std::vector<Color> const & rvPalette, sal_uInt8 nIndex)
+{
+    if (nIndex >= rvPalette.size())
+    {
+        auto nSanitizedIndex = nIndex % rvPalette.size();
+        SAL_WARN_IF(nIndex != nSanitizedIndex, "filter.pict", "invalid palette index: "
+                    << static_cast<unsigned int>(nIndex) << ", palette len is: "
+                    << rvPalette.size());
+        nIndex = nSanitizedIndex;
+    }
+    return rvPalette[nIndex];
+}
+
 static void SetByte(sal_uInt16& nx, sal_uInt16 ny, vcl::bitmap::RawBitmap& rBitmap, sal_uInt16 nPixelSize, sal_uInt8 nDat, sal_uInt16 nWidth, std::vector<Color> const & rvPalette)
 {
     switch (nPixelSize)
     {
         case 1:
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 7) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 7) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 6) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 6) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 5) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 5) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 4) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 4) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 3) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 3) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 2) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 2) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat >> 1) & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat >> 1) & 1));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat & 1]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat & 1));
             break;
         case 2:
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat >> 6]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat >> 6));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat>>4)&3]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat>>4)&3));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[(nDat>>2)&3]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, (nDat>>2)&3));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat & 3]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat & 3));
             break;
         case 4:
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat >> 4]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat >> 4));
             if ( nx == nWidth ) break;
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat & 0x0f]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat & 0x0f));
             break;
         case 8:
-            rBitmap.SetPixel(ny, nx++, rvPalette[nDat]);
+            rBitmap.SetPixel(ny, nx++, SanitizePaletteIndex(rvPalette, nDat));
             break;
     }
 }
-- 
2.39.5