From 2105b200df3ddda1e51f7ca9b2bac561da44188d Mon Sep 17 00:00:00 2001 From: skal Date: Sat, 14 Nov 2020 08:57:59 +0000 Subject: [PATCH] More overflow fixes for large width Also: use INT_MAX instead of hard-coded constants. --- libtiff/tif_getimage.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 0ad79b7f..3460af74 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -774,10 +774,18 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ((tw + w) > INT_MAX) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = h - 1; toskew = -(int32)(tw + w); } else { + if (tw > (INT_MAX + w)) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = 0; toskew = -(int32)(tw - w); } @@ -945,9 +953,9 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { - if ( w > 0x7FFFFFFFu ) { - TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); - return (0); + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); } y = h - 1; toskew = -(int32)(w + w); @@ -1045,6 +1053,10 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); + } y = h - 1; toskew = -(int32)(w + w); }