From 1e2aed280757743b469d0c22d451599bb56e57e6 Mon Sep 17 00:00:00 2001
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
Date: Tue, 31 May 2011 16:51:50 +0000
Subject: [PATCH] * libtiff/tif_jpeg.c (JPEGDecodeRaw) [JPEG_LIB_MK1_OR_12BIT]:
 Diagnose out-of-memory failure and return 0 rather than dereferencing NULL.

---
 ChangeLog          | 6 ++++++
 libtiff/tif_jpeg.c | 7 ++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 49d2a41f..40b96e6b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2011-05-31  Jim Meyering  <meyering@redhat.com>
+
+	* libtiff/tif_jpeg.c (JPEGDecodeRaw) [JPEG_LIB_MK1_OR_12BIT]:
+	Diagnose out-of-memory failure and return 0 rather than
+	dereferencing NULL.
+
 2011-05-24  Frank Warmerdam  <warmerdam@pobox.com>
 
 	* libtiff/tif_dirread.c: produce special error message for zero tag
diff --git a/libtiff/tif_jpeg.c b/libtiff/tif_jpeg.c
index b59c6301..1cea92f3 100644
--- a/libtiff/tif_jpeg.c
+++ b/libtiff/tif_jpeg.c
@@ -1,4 +1,4 @@
-/* $Id: tif_jpeg.c,v 1.101 2011-02-23 21:58:00 fwarmerdam Exp $ */
+/* $Id: tif_jpeg.c,v 1.102 2011-05-31 16:51:50 bfriesen Exp $ */
 
 /*
  * Copyright (c) 1994-1997 Sam Leffler
@@ -1351,6 +1351,11 @@ JPEGDecodeRaw(TIFF* tif, uint8* buf, tmsize_t cc, uint16 s)
 		unsigned short* tmpbuf = _TIFFmalloc(sizeof(unsigned short) *
 		    sp->cinfo.d.output_width *
 		    sp->cinfo.d.num_components);
+		if(tmpbuf==NULL) {
+                        TIFFErrorExt(tif->tif_clientdata, "JPEGDecodeRaw",
+				     "Out of memory");
+			return 0;
+                }
 #endif
 
 		do {