cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* tools/tiffinfo.c: fix out-of-bound read on some tiled images.

Browse Source 
(http://bugzilla.maptools.org/show_bug.cgi?id=2517)

* libtiff/tif_compress.c: make TIFFNoDecode() return 0 to indicate an
error and make upper level read routines treat it accordingly.
(linked to the test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)
This commit is contained in:
Even Rouault 2016-10-25 20:04:21 +00:00
parent 0d521dfab0
commit 0c05834d05
3 changed files with 30 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,12 @@
2016-10-25 Even Rouault <even.rouault at spatialys.com>
* tools/tiffinfo.c: fix out-of-bound read on some tiled images.
(http://bugzilla.maptools.org/show_bug.cgi?id=2517)
* libtiff/tif_compress.c: make TIFFNoDecode() return 0 to indicate an
error and make upper level read routines treat it accordingly.
(linked to the test case of http://bugzilla.maptools.org/show_bug.cgi?id=2517)
2016-10-14 Even Rouault <even.rouault at spatialys.com> 2016-10-14 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in * tools/tiffcrop.c: fix out-of-bound read of up to 3 bytes in

4
libtiff/tif_compress.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_compress.c,v 1.24 2015-11-22 15:31:03 erouault Exp $ */ /* $Id: tif_compress.c,v 1.25 2016-10-25 20:04:22 erouault Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -82,7 +82,7 @@ TIFFNoDecode(TIFF* tif, const char* method)
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
"Compression scheme %u %s decoding is not implemented", "Compression scheme %u %s decoding is not implemented",
tif->tif_dir.td_compression, method); tif->tif_dir.td_compression, method);
return (-1); return (0);
} }
static int static int

24
tools/tiffinfo.c
View File

@ -1,4 +1,4 @@
/* $Id: tiffinfo.c,v 1.23 2015-06-21 01:09:11 bfriesen Exp $ */ /* $Id: tiffinfo.c,v 1.24 2016-10-25 20:04:22 erouault Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -294,9 +294,10 @@ void
TIFFReadContigTileData(TIFF* tif) TIFFReadContigTileData(TIFF* tif)
{ {
unsigned char *buf; unsigned char *buf;
tsize_t rowsize = TIFFTileRowSize(tif); tmsize_t rowsize = TIFFTileRowSize(tif);
tmsize_t tilesize = TIFFTileSize(tif);
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); buf = (unsigned char *)_TIFFmalloc(tilesize);
if (buf) { if (buf) {
uint32 tw=0, th=0, w=0, h=0; uint32 tw=0, th=0, w=0, h=0;
uint32 row, col; uint32 row, col;
@ -305,6 +306,12 @@ TIFFReadContigTileData(TIFF* tif)
TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h); TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h);
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
if( rowsize == 0 || th > tilesize / rowsize )
{
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
_TIFFfree(buf);
return;
}
for (row = 0; row < h; row += th) { for (row = 0; row < h; row += th) {
for (col = 0; col < w; col += tw) { for (col = 0; col < w; col += tw) {
if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) { if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) {
@ -322,9 +329,10 @@ void
TIFFReadSeparateTileData(TIFF* tif) TIFFReadSeparateTileData(TIFF* tif)
{ {
unsigned char *buf; unsigned char *buf;
tsize_t rowsize = TIFFTileRowSize(tif); tmsize_t rowsize = TIFFTileRowSize(tif);
tmsize_t tilesize = TIFFTileSize(tif);
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); buf = (unsigned char *)_TIFFmalloc(tilesize);
if (buf) { if (buf) {
uint32 tw=0, th=0, w=0, h=0; uint32 tw=0, th=0, w=0, h=0;
uint32 row, col; uint32 row, col;
@ -335,6 +343,12 @@ TIFFReadSeparateTileData(TIFF* tif)
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel); TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel);
if( rowsize == 0 || th > tilesize / rowsize )
{
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
_TIFFfree(buf);
return;
}
for (row = 0; row < h; row += th) { for (row = 0; row < h; row += th) {
for (col = 0; col < w; col += tw) { for (col = 0; col < w; col += tw) {
for (s = 0; s < samplesperpixel; s++) { for (s = 0; s < samplesperpixel; s++) {