cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tif_fax3: more buffer overflow checks in Fax3Decode2D()

Browse Source 
fixes #185
This commit is contained in:
Thomas Bernard 2020-03-23 17:00:23 +01:00
parent 443bd37f65
commit 3440ac2164
No known key found for this signature in database
GPG Key ID: 0FF11B67A5C0863C
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libtiff/tif_fax3.c
View File

@ -305,7 +305,9 @@ Fax3Decode2D(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
else
EXPAND2D(EOF2Da);
(*sp->fill)(buf, thisrun, pa, lastx);
SETVALUE(0); /* imaginary change for reference */
if (pa < thisrun + sp->nruns) {
SETVALUE(0); /* imaginary change for reference */
}
SWAP(uint32*, sp->curruns, sp->refruns);
buf += sp->b.rowbytes;
occ -= sp->b.rowbytes;

9
libtiff/tif_fax3.h
View File

@ -514,9 +514,9 @@ done1d: \
goto eol2d; \
eof2d: \
prematureEOF(a0); \
if (pa < thisrun + sp->nruns) { \
if (pa < thisrun + sp->nruns) { \
CLEANUP_RUNS(); \
} \
} \
goto eoflab; \
} \
} \
@ -531,9 +531,12 @@ done1d: \
SETVALUE(0); \
} \
eol2d: \
CLEANUP_RUNS(); \
if (pa < thisrun + sp->nruns) { \
CLEANUP_RUNS(); \
} \
} while (0)
#endif /* _FAX3_ */
/* vim: set ts=8 sts=4 sw=4 noet: */
/*
* Local Variables:
* mode: c