From f1b94e8a3ba49febdd3361c0214a1d1149251577 Mon Sep 17 00:00:00 2001 From: Young_X Date: Sat, 8 Sep 2018 14:36:12 +0800 Subject: [PATCH 1/3] only read/write TIFFTAG_GROUP3OPTIONS or TIFFTAG_GROUP4OPTIONS if compression is COMPRESSION_CCITTFAX3 or COMPRESSION_CCITTFAX4 --- tools/pal2rgb.c | 18 +++++++++++++++++- tools/tiff2bw.c | 18 +++++++++++++++++- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c index 01fcf941..01d8502e 100644 --- a/tools/pal2rgb.c +++ b/tools/pal2rgb.c @@ -402,7 +402,23 @@ cpTags(TIFF* in, TIFF* out) { struct cpTag *p; for (p = tags; p < &tags[NTAGS]; p++) - cpTag(in, out, p->tag, p->count, p->type); + { + if( p->tag == TIFFTAG_GROUP3OPTIONS ) + { + uint16 compression; + if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) || + compression != COMPRESSION_CCITTFAX3 ) + continue; + } + if( p->tag == TIFFTAG_GROUP4OPTIONS ) + { + uint16 compression; + if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) || + compression != COMPRESSION_CCITTFAX4 ) + continue; + } + cpTag(in, out, p->tag, p->count, p->type); + } } #undef NTAGS diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c index 05faba87..5bef3142 100644 --- a/tools/tiff2bw.c +++ b/tools/tiff2bw.c @@ -450,7 +450,23 @@ cpTags(TIFF* in, TIFF* out) { struct cpTag *p; for (p = tags; p < &tags[NTAGS]; p++) - cpTag(in, out, p->tag, p->count, p->type); + { + if( p->tag == TIFFTAG_GROUP3OPTIONS ) + { + uint16 compression; + if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) || + compression != COMPRESSION_CCITTFAX3 ) + continue; + } + if( p->tag == TIFFTAG_GROUP4OPTIONS ) + { + uint16 compression; + if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) || + compression != COMPRESSION_CCITTFAX4 ) + continue; + } + cpTag(in, out, p->tag, p->count, p->type); + } } #undef NTAGS From 6da1fb3f64d43be37e640efbec60400d1f1ac39e Mon Sep 17 00:00:00 2001 From: Young_X Date: Sat, 8 Sep 2018 14:46:27 +0800 Subject: [PATCH 2/3] avoid potential int32 overflows in multiply_ms() --- tools/ppm2tiff.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/tools/ppm2tiff.c b/tools/ppm2tiff.c index af6e4124..c2d59257 100644 --- a/tools/ppm2tiff.c +++ b/tools/ppm2tiff.c @@ -70,15 +70,16 @@ BadPPM(char* file) exit(-2); } + +#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0)) +#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1) + static tmsize_t multiply_ms(tmsize_t m1, tmsize_t m2) { - tmsize_t bytes = m1 * m2; - - if (m1 && bytes / m1 != m2) - bytes = 0; - - return bytes; + if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 ) + return 0; + return m1 * m2; } int From 97c95667f615b2ce793d162fd26c05c3901a9043 Mon Sep 17 00:00:00 2001 From: Young_X Date: Sat, 8 Sep 2018 15:07:53 +0800 Subject: [PATCH 3/3] fix out-of-bound read on some tiled images. --- tools/tiffinfoce.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/tools/tiffinfoce.c b/tools/tiffinfoce.c index 1822a550..b90f0382 100644 --- a/tools/tiffinfoce.c +++ b/tools/tiffinfoce.c @@ -290,17 +290,24 @@ void TIFFReadContigTileData(TIFF* tif) { unsigned char *buf; - tsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t tilesize = TIFFTileSize(tif); - buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); + buf = (unsigned char *)_TIFFmalloc(tilesize); if (buf) { - uint32 tw, th, w, h; + uint32 tw=0, th=0, w=0, h=0; uint32 row, col; TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w); TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); + if( rowsize == 0 || th > tilesize / rowsize ) + { + fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n"); + _TIFFfree(buf); + return; + } for (row = 0; row < h; row += th) { for (col = 0; col < w; col += tw) { if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) { @@ -318,11 +325,12 @@ void TIFFReadSeparateTileData(TIFF* tif) { unsigned char *buf; - tsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t rowsize = TIFFTileRowSize(tif); + tmsize_t tilesize = TIFFTileSize(tif); - buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); + buf = (unsigned char *)_TIFFmalloc(tilesize); if (buf) { - uint32 tw, th, w, h; + uint32 tw=0, th=0, w=0, h=0; uint32 row, col; tsample_t s, samplesperpixel; @@ -331,6 +339,12 @@ TIFFReadSeparateTileData(TIFF* tif) TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel); + if( rowsize == 0 || th > tilesize / rowsize ) + { + fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n"); + _TIFFfree(buf); + return; + } for (row = 0; row < h; row += th) { for (col = 0; col < w; col += tw) { for (s = 0; s < samplesperpixel; s++) {