cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'skal65535-master-patch-91082' into 'master'

Browse Source 
More overflow fixes for large widths

See merge request libtiff/libtiff!164
This commit is contained in:
Even Rouault 2020-11-14 12:44:43 +00:00
commit 026c2bce9f
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libtiff/tif_getimage.c
View File

@ -774,10 +774,18 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img); flip = setorientation(img);
if (flip & FLIP_VERTICALLY) { if (flip & FLIP_VERTICALLY) {
if ((tw + w) > INT_MAX) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = h - 1; y = h - 1;
toskew = -(int32)(tw + w); toskew = -(int32)(tw + w);
} }
else { else {
if (tw > (INT_MAX + w)) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = 0; y = 0;
toskew = -(int32)(tw - w); toskew = -(int32)(tw - w);
} }
@ -945,9 +953,9 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img); flip = setorientation(img);
if (flip & FLIP_VERTICALLY) { if (flip & FLIP_VERTICALLY) {
if ( w > 0x7FFFFFFFu ) { if ( w > INT_MAX ) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow");
return (0); return (0);
} }
y = h - 1; y = h - 1;
toskew = -(int32)(w + w); toskew = -(int32)(w + w);
@ -1045,6 +1053,10 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img); flip = setorientation(img);
if (flip & FLIP_VERTICALLY) { if (flip & FLIP_VERTICALLY) {
if ( w > INT_MAX ) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow");
return (0);
}
y = h - 1; y = h - 1;
toskew = -(int32)(w + w); toskew = -(int32)(w + w);
} }