diff --git a/ChangeLog b/ChangeLog index 84d016d7..ae09b648 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2016-10-25 Even Rouault + + * tools/tiffinfo.c: fix out-of-bound read on some tiled images. + (http://bugzilla.maptools.org/show_bug.cgi?id=2517) + + * libtiff/tif_compress.c: make TIFFNoDecode() return 0 to indicate an + error and make upper level read routines treat it accordingly. + (linked to the test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517) + 2016-10-14 Even Rouault * tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in diff --git a/libtiff/tif_compress.c b/libtiff/tif_compress.c index f6b32df1..b571d195 100644 --- a/libtiff/tif_compress.c +++ b/libtiff/tif_compress.c @@ -1,4 +1,4 @@ -/* $Id: tif_compress.c,v 1.24 2015-11-22 15:31:03 erouault Exp $ */ +/* $Id: tif_compress.c,v 1.25 2016-10-25 20:04:22 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -82,7 +82,7 @@ TIFFNoDecode(TIFF* tif, const char* method) TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Compression scheme %u %s decoding is not implemented", tif->tif_dir.td_compression, method); - return (-1); + return (0); } static int diff --git a/tools/tiffinfo.c b/tools/tiffinfo.c index acac2e42..fad7404e 100644 --- a/tools/tiffinfo.c +++ b/tools/tiffinfo.c @@ -1,4 +1,4 @@ -/* $Id: tiffinfo.c,v 1.23 2015-06-21 01:09:11 bfriesen Exp $ */ +/* $Id: tiffinfo.c,v 1.24 2016-10-25 20:04:22 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -294,9 +294,10 @@ void TIFFReadContigTileData(TIFF* tif) { unsigned char *buf; - tsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t tilesize = TIFFTileSize(tif); - buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); + buf = (unsigned char *)_TIFFmalloc(tilesize); if (buf) { uint32 tw=0, th=0, w=0, h=0; uint32 row, col; @@ -305,6 +306,12 @@ TIFFReadContigTileData(TIFF* tif) TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); + if( rowsize == 0 || th > tilesize / rowsize ) + { + fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n"); + _TIFFfree(buf); + return; + } for (row = 0; row < h; row += th) { for (col = 0; col < w; col += tw) { if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) { @@ -322,9 +329,10 @@ void TIFFReadSeparateTileData(TIFF* tif) { unsigned char *buf; - tsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t tilesize = TIFFTileSize(tif); - buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); + buf = (unsigned char *)_TIFFmalloc(tilesize); if (buf) { uint32 tw=0, th=0, w=0, h=0; uint32 row, col; @@ -335,6 +343,12 @@ TIFFReadSeparateTileData(TIFF* tif) TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel); + if( rowsize == 0 || th > tilesize / rowsize ) + { + fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n"); + _TIFFfree(buf); + return; + } for (row = 0; row < h; row += th) { for (col = 0; col < w; col += tw) { for (s = 0; s < samplesperpixel; s++) {