cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PSDataColorContig(): avoid heap buffer overrun

Browse Source 
fixes http://bugzilla.maptools.org/show_bug.cgi?id=2844
each iteration of the loop read nc bytes
This commit is contained in:
Thomas Bernard 2019-02-24 00:50:12 +01:00
parent 3c792f726b
commit 05029fb7f1
No known key found for this signature in database
GPG Key ID: 0FF11B67A5C0863C
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/tiff2ps.c
View File

@ -2468,7 +2468,7 @@ PSDataColorContig(FILE* fd, TIFF* tif, uint32 w, uint32 h, int nc)
if (alpha) { if (alpha) {
int adjust; int adjust;
cc = 0; cc = 0;
for (; cc < tf_bytesperrow; cc += samplesperpixel) { for (; (cc + nc) <= tf_bytesperrow; cc += samplesperpixel) {
DOBREAK(breaklen, nc, fd); DOBREAK(breaklen, nc, fd);
/* /*
* For images with alpha, matte against * For images with alpha, matte against
@ -2487,7 +2487,7 @@ PSDataColorContig(FILE* fd, TIFF* tif, uint32 w, uint32 h, int nc)
} }
} else { } else {
cc = 0; cc = 0;
for (; cc < tf_bytesperrow; cc += samplesperpixel) { for (; (cc + nc) <= tf_bytesperrow; cc += samplesperpixel) {
DOBREAK(breaklen, nc, fd); DOBREAK(breaklen, nc, fd);
switch (nc) { switch (nc) {
case 4: c = *cp++; PUTHEX(c,fd); case 4: c = *cp++; PUTHEX(c,fd);