cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-160' into 'master'

Browse Source 
Fax3SetupState(): check consistency of rowbytes and rowpixels

Closes #160

See merge request libtiff/libtiff!123
This commit is contained in:
Even Rouault 2020-03-11 23:55:10 +00:00
commit 08e67f831a
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libtiff/tif_fax3.c
View File

@ -219,8 +219,12 @@ Fax3PrematureEOF(const char* module, TIFF* tif, uint32 line, uint32 a0)
#define Nop #define Nop
/* /**
* Decode the requested amount of G3 1D-encoded data. * Decode the requested amount of G3 1D-encoded data.
* @param buf destination buffer
* @param occ available bytes in destination buffer
* @param s number of planes (ignored)
* @returns 1 for success, -1 in case of error
*/ */
static int static int
Fax3Decode1D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) Fax3Decode1D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
@ -524,6 +528,13 @@ Fax3SetupState(TIFF* tif)
rowbytes = TIFFScanlineSize(tif); rowbytes = TIFFScanlineSize(tif);
rowpixels = td->td_imagewidth; rowpixels = td->td_imagewidth;
} }
if (rowbytes < (rowpixels + 7) / 8)
{
TIFFErrorExt(tif->tif_clientdata, module,
"Inconsistent number of bytes per row : rowbytes=%lu rowpixels=%lu",
(unsigned long)(rowbytes), (unsigned long)(rowpixels));
return (0);
}
sp->rowbytes = rowbytes; sp->rowbytes = rowbytes;
sp->rowpixels = rowpixels; sp->rowpixels = rowpixels;
/* /*