cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_dirread.c: reject images with OJPEG compression that

Browse Source 
have no TileOffsets/StripOffsets tag, when OJPEG compression is
disabled. Prevent null pointer dereference in TIFFReadRawStrip1()
and other functions that expect td_stripbytecount to be non NULL.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585
This commit is contained in:
Even Rouault 2016-11-11 20:01:55 +00:00
parent 49062afa56
commit 1120426ba0
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2016-11-11 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_dirread.c: reject images with OJPEG compression that
have no TileOffsets/StripOffsets tag, when OJPEG compression is
disabled. Prevent null pointer dereference in TIFFReadRawStrip1()
and other functions that expect td_stripbytecount to be non NULL.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585
2016-11-11 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcrop.c: fix multiple uint32 overflows in

7
libtiff/tif_dirread.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_dirread.c,v 1.201 2016-04-27 11:38:00 erouault Exp $ */
/* $Id: tif_dirread.c,v 1.202 2016-11-11 20:01:55 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -3628,6 +3628,7 @@ TIFFReadDirectory(TIFF* tif)
if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
#ifdef OJPEG_SUPPORT
if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
(isTiled(tif)==0) &&
(tif->tif_dir.td_nstrips==1)) {
@ -3640,7 +3641,9 @@ TIFFReadDirectory(TIFF* tif)
* JpegInterchangeFormat stream.
*/
TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
} else {
} else
#endif
{
MissingRequired(tif,
isTiled(tif) ? "TileOffsets" : "StripOffsets");
goto bad;