cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

check that (Tile Width)*(Samples/Pixel) do no overflow

Browse Source 
fixes bug 2833
This commit is contained in:
Thomas Bernard 2019-02-11 10:05:33 +01:00
parent ae0bed1fe5
commit 2b0d0e6997
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tools/tiffcp.c
View File

@ -1408,7 +1408,7 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
int status = 1; int status = 1;
uint32 imagew = TIFFRasterScanlineSize(in); uint32 imagew = TIFFRasterScanlineSize(in);
uint32 tilew = TIFFTileRowSize(in); uint32 tilew = TIFFTileRowSize(in);
int iskew = imagew - tilew*spp; int iskew;
tsize_t tilesize = TIFFTileSize(in); tsize_t tilesize = TIFFTileSize(in);
tdata_t tilebuf; tdata_t tilebuf;
uint8* bufp = (uint8*) buf; uint8* bufp = (uint8*) buf;
@ -1416,6 +1416,12 @@ DECLAREreadFunc(readSeparateTilesIntoBuffer)
uint32 row; uint32 row;
uint16 bps = 0, bytes_per_sample; uint16 bps = 0, bytes_per_sample;
if (spp > (0x7fffffff / tilew))
{
TIFFError(TIFFFileName(in), "Error, cannot handle that much samples per tile row (Tile Width * Samples/Pixel)");
return 0;
}
iskew = imagew - tilew*spp;
tilebuf = _TIFFmalloc(tilesize); tilebuf = _TIFFmalloc(tilesize);
if (tilebuf == 0) if (tilebuf == 0)
return 0; return 0;