diff --git a/ChangeLog b/ChangeLog index 4ba53b4a..91c2182b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,16 @@ +2010-07-01 Andrey Kiselev + + * tools/tiffgt.c: Properly check the raster buffer allocations for + integer overflows. As per bug + http://bugzilla.maptools.org/show_bug.cgi?id=2108 + + * m4/acinclude.m4: Update GL/GLU/GLUt/Pthread macros from the + upstream. + + * libtiff/{tif_aux.c, tif_strip.c, tif_tile.c, tiffiop.h}: Move + multiply_32() and multiply_64() functions into tif_aux.c file and + rename them into _TIFFMultiply32() and _TIFFMultiply64() respectively. + 2010-06-30 Andrey Kiselev * tools/tiff2pdf.c: Better generation of ID field in diff --git a/tools/tiffgt.c b/tools/tiffgt.c index 33336907..de420396 100644 --- a/tools/tiffgt.c +++ b/tools/tiffgt.c @@ -1,4 +1,4 @@ -/* $Id: tiffgt.c,v 1.9 2010-03-10 18:56:50 bfriesen Exp $ */ +/* $Id: tiffgt.c,v 1.10 2010-07-01 15:56:56 dron Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -40,6 +40,7 @@ #endif #include "tiffio.h" +#include "tiffiop.h" #ifndef HAVE_GETOPT extern int getopt(int, char**, char*); @@ -224,21 +225,24 @@ initImage(void) w = xmax; } - if (w != width || h != height) { - if (raster != NULL) - _TIFFfree(raster), raster = NULL; - raster = (uint32*) _TIFFmalloc(img.width * img.height * sizeof (uint32)); - if (raster == NULL) { - width = height = 0; - TIFFError(filelist[fileindex], "No space for raster buffer"); - cleanup_and_exit(); - } - width = w; - height = h; - } - TIFFRGBAImageGet(&img, raster, img.width, img.height); + if (w != width || h != height) { + uint32 rastersize = + _TIFFMultiply32(tif, img.width, img.height, "allocating raster buffer"); + if (raster != NULL) + _TIFFfree(raster), raster = NULL; + raster = (uint32*) _TIFFCheckMalloc(tif, rastersize, sizeof (uint32), + "allocating raster buffer"); + if (raster == NULL) { + width = height = 0; + TIFFError(filelist[fileindex], "No space for raster buffer"); + cleanup_and_exit(); + } + width = w; + height = h; + } + TIFFRGBAImageGet(&img, raster, img.width, img.height); #if HOST_BIGENDIAN - TIFFSwabArrayOfLong(raster,img.width*img.height); + TIFFSwabArrayOfLong(raster,img.width*img.height); #endif return 0; }