cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non assert check.

Browse Source 
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2605
This commit is contained in:
Even Rouault 2016-12-03 16:50:02 +00:00
parent bae8284136
commit 2766c8583d
2 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2016-12-03 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcp.c: replace assert( (bps % 8) == 0 ) by a non assert check.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2605
2016-12-03 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based

17
tools/tiffcp.c
View File

@ -1,4 +1,4 @@
/* $Id: tiffcp.c,v 1.59 2016-12-03 16:40:01 erouault Exp $ */
/* $Id: tiffcp.c,v 1.60 2016-12-03 16:50:02 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -45,7 +45,6 @@
#include <string.h>
#include <ctype.h>
#include <assert.h>
#ifdef HAVE_UNISTD_H
# include <unistd.h>
@ -1393,7 +1392,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
status = 0;
goto done;
}
assert( bps % 8 == 0 );
if( (bps % 8) != 0 )
{
TIFFError(TIFFFileName(in), "Error, cannot handle BitsPerSample that is not a multiple of 8");
status = 0;
goto done;
}
bytes_per_sample = bps/8;
for (row = 0; row < imagelength; row += tl) {
@ -1584,7 +1588,12 @@ DECLAREwriteFunc(writeBufferToSeparateTiles)
_TIFFfree(obuf);
return 0;
}
assert( bps % 8 == 0 );
if( (bps % 8) != 0 )
{
TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
_TIFFfree(obuf);
return 0;
}
bytes_per_sample = bps/8;
for (row = 0; row < imagelength; row += tl) {