cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-185' into 'master'

Browse Source 
tif_fax3: more buffer overflow checks in Fax3Decode2D()

Closes #185

See merge request libtiff/libtiff!131
This commit is contained in:
Even Rouault 2020-03-23 18:05:54 +00:00
commit 204c464327
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libtiff/tif_fax3.c
View File

@ -305,7 +305,9 @@ Fax3Decode2D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
else else
EXPAND2D(EOF2Da); EXPAND2D(EOF2Da);
(*sp->fill)(buf, thisrun, pa, lastx); (*sp->fill)(buf, thisrun, pa, lastx);
SETVALUE(0); /* imaginary change for reference */ if (pa < thisrun + sp->nruns) {
SETVALUE(0); /* imaginary change for reference */
}
SWAP(uint32*, sp->curruns, sp->refruns); SWAP(uint32*, sp->curruns, sp->refruns);
buf += sp->b.rowbytes; buf += sp->b.rowbytes;
occ -= sp->b.rowbytes; occ -= sp->b.rowbytes;

9
libtiff/tif_fax3.h
View File

@ -514,9 +514,9 @@ done1d: \
goto eol2d; \ goto eol2d; \
eof2d: \ eof2d: \
prematureEOF(a0); \ prematureEOF(a0); \
if (pa < thisrun + sp->nruns) { \ if (pa < thisrun + sp->nruns) { \
CLEANUP_RUNS(); \ CLEANUP_RUNS(); \
} \ } \
goto eoflab; \ goto eoflab; \
} \ } \
} \ } \
@ -531,9 +531,12 @@ done1d: \
SETVALUE(0); \ SETVALUE(0); \
} \ } \
eol2d: \ eol2d: \
CLEANUP_RUNS(); \ if (pa < thisrun + sp->nruns) { \
CLEANUP_RUNS(); \
} \
} while (0) } while (0)
#endif /* _FAX3_ */ #endif /* _FAX3_ */
/* vim: set ts=8 sts=4 sw=4 noet: */
/* /*
* Local Variables: * Local Variables:
* mode: c * mode: c