From bb1ab756d6d181db4d915d446c2812c6e8b80bac Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Sun, 5 Apr 2020 00:01:59 +0200 Subject: [PATCH 1/3] tiff2pdf: get rid of uninitialized memory content fixes #176 --- tools/tiff2pdf.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 5770a1ff..1be97f8c 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -2282,6 +2282,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); TIFFReadRawStrip(input, 0, (tdata_t) buffer, t2p->tiff_datasize); if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ @@ -2310,7 +2311,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); TIFFReadRawStrip(input, 0, (tdata_t) buffer, t2p->tiff_datasize); if (t2p->tiff_fillorder==FILLORDER_LSB2MSB) { @@ -2337,7 +2338,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); if(t2p->pdf_ojpegiflength==0){ inputoffset=t2pSeekFile(input, 0, SEEK_CUR); @@ -2413,7 +2414,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); _TIFFmemcpy(buffer, t2p->pdf_ojpegdata, t2p->pdf_ojpegdatalength); bufferoffset=t2p->pdf_ojpegdatalength; stripcount=TIFFNumberOfStrips(input); @@ -2462,7 +2463,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); if (TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { if(count > 4) { _TIFFmemcpy(buffer, jpt, count); @@ -2485,6 +2486,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(stripbuffer, 0, max_striplength); for(i=0;it2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); stripsize=TIFFStripSize(input); stripcount=TIFFNumberOfStrips(input); for(i=0;it2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); samplebuffer = (unsigned char*) _TIFFmalloc(stripsize); if(samplebuffer==NULL){ TIFFError(TIFF2PDF_MODULE, @@ -2613,7 +2615,7 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ t2p->t2p_error = T2P_ERR_ERROR; return(0); } - memset(buffer, 0, t2p->tiff_datasize); + memset(buffer, 0, t2p->tiff_datasize); stripsize=TIFFStripSize(input); stripcount=TIFFNumberOfStrips(input); for(i=0;it2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ TIFFReverseBits(buffer, t2p->tiff_datasize); @@ -2898,6 +2901,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ TIFFReverseBits(buffer, t2p->tiff_datasize); @@ -2927,6 +2931,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); _TIFFmemcpy(buffer, t2p->pdf_ojpegdata, t2p->pdf_ojpegdatalength); if(edge!=0){ if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile)){ @@ -2968,6 +2973,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { if (count > 4) { int retTIFFReadRawTile; @@ -3016,6 +3022,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); read = TIFFReadEncodedTile( input, @@ -3049,6 +3056,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); samplebuffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(samplebuffer==NULL){ TIFFError(TIFF2PDF_MODULE, @@ -3060,6 +3068,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(samplebuffer, 0, t2p->tiff_datasize); samplebufferoffset=0; for(i=0;itiff_samplesperpixel;i++){ read = @@ -3099,6 +3108,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p->t2p_error = T2P_ERR_ERROR; return(0); } + memset(buffer, 0, t2p->tiff_datasize); read = TIFFReadEncodedTile( input, tile, From 8fed45347eb35adb6b428b133d519d89fd2ae1f3 Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Sun, 5 Apr 2020 00:13:13 +0200 Subject: [PATCH 2/3] tiff2pdf.c: fix some whitespace problems in source --- tools/tiff2pdf.c | 124 +++++++++++++++++++++++------------------------ 1 file changed, 62 insertions(+), 62 deletions(-) diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 1be97f8c..355e8461 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -1030,14 +1030,14 @@ void t2p_validate(T2P* t2p){ #endif #ifdef ZIP_SUPPORT if(t2p->pdf_defaultcompression==T2P_COMPRESS_ZIP){ - uint16 m=t2p->pdf_defaultcompressionquality%100; - if(t2p->pdf_defaultcompressionquality/100 > 9 || - (m>1 && m<10) || m>15){ - t2p->pdf_defaultcompressionquality=0; + uint16 m=t2p->pdf_defaultcompressionquality%100; + if(t2p->pdf_defaultcompressionquality/100 > 9 || + (m>1 && m<10) || m>15){ + t2p->pdf_defaultcompressionquality=0; } if(t2p->pdf_defaultcompressionquality%100 !=0){ - t2p->pdf_defaultcompressionquality/=100; - t2p->pdf_defaultcompressionquality*=100; + t2p->pdf_defaultcompressionquality/=100; + t2p->pdf_defaultcompressionquality*=100; TIFFError( TIFF2PDF_MODULE, "PNG Group predictor differencing not implemented, assuming compression quality %u", @@ -2137,7 +2137,7 @@ void t2p_read_tiff_size_tile(T2P* t2p, TIFF* input, ttile_t tile){ k=tbc[tile]; #ifdef OJPEG_SUPPORT if(t2p->tiff_compression==COMPRESSION_OJPEG){ - k = checkAdd64(k, 2048, t2p); + k = checkAdd64(k, 2048, t2p); } #endif #ifdef JPEG_SUPPORT @@ -2274,10 +2274,10 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if (buffer == NULL) { - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for " - "t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for " + "t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2304,9 +2304,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer == NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2331,9 +2331,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer == NULL) { - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2398,8 +2398,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ } } else { if(! t2p->pdf_ojpegdata){ - TIFFError(TIFF2PDF_MODULE, - "No support for OJPEG image %s with bad tables", + TIFFError(TIFF2PDF_MODULE, + "No support for OJPEG image %s with bad tables", TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2407,9 +2407,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2456,9 +2456,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2478,9 +2478,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ stripbuffer = (unsigned char*) _TIFFmalloc(max_striplength); if(stripbuffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", - max_striplength, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %u bytes of memory for t2p_readwrite_pdf_image, %s", + max_striplength, TIFFFileName(input)); _TIFFfree(buffer); t2p->t2p_error = T2P_ERR_ERROR; @@ -2520,9 +2520,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ if(t2p->pdf_sample==T2P_SAMPLE_NOTHING){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2558,9 +2558,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -2568,9 +2568,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ memset(buffer, 0, t2p->tiff_datasize); samplebuffer = (unsigned char*) _TIFFmalloc(stripsize); if(samplebuffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; _TIFFfree(buffer); @@ -2585,9 +2585,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ (tdata_t) &(samplebuffer[samplebufferoffset]), TIFFmin(sepstripsize, stripsize - samplebufferoffset)); if(read==-1){ - TIFFError(TIFF2PDF_MODULE, - "Error on decoding strip %u of %s", - i + j*stripcount, + TIFFError(TIFF2PDF_MODULE, + "Error on decoding strip %u of %s", + i + j*stripcount, TIFFFileName(input)); _TIFFfree(buffer); t2p->t2p_error=T2P_ERR_ERROR; @@ -2608,9 +2608,9 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", - (unsigned long) t2p->tiff_datasize, + TIFFError(TIFF2PDF_MODULE, + "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -3048,10 +3048,10 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ tilecount=septilecount/t2p->tiff_samplesperpixel; buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, + TIFFError(TIFF2PDF_MODULE, "Can't allocate %lu bytes of memory " - "for t2p_readwrite_pdf_image_tile, %s", - (unsigned long) t2p->tiff_datasize, + "for t2p_readwrite_pdf_image_tile, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -3059,10 +3059,10 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ memset(buffer, 0, t2p->tiff_datasize); samplebuffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(samplebuffer==NULL){ - TIFFError(TIFF2PDF_MODULE, + TIFFError(TIFF2PDF_MODULE, "Can't allocate %lu bytes of memory " - "for t2p_readwrite_pdf_image_tile, %s", - (unsigned long) t2p->tiff_datasize, + "for t2p_readwrite_pdf_image_tile, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); _TIFFfree(buffer); t2p->t2p_error = T2P_ERR_ERROR; @@ -3100,10 +3100,10 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ if(buffer==NULL){ buffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); if(buffer==NULL){ - TIFFError(TIFF2PDF_MODULE, + TIFFError(TIFF2PDF_MODULE, "Can't allocate %lu bytes of memory " - "for t2p_readwrite_pdf_image_tile, %s", - (unsigned long) t2p->tiff_datasize, + "for t2p_readwrite_pdf_image_tile, %s", + (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; return(0); @@ -3115,9 +3115,9 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ (tdata_t) &buffer[bufferoffset], t2p->tiff_datasize); if(read==-1){ - TIFFError(TIFF2PDF_MODULE, - "Error on decoding tile %u of %s", - tile, + TIFFError(TIFF2PDF_MODULE, + "Error on decoding tile %u of %s", + tile, TIFFFileName(input)); _TIFFfree(buffer); t2p->t2p_error=T2P_ERR_ERROR; @@ -3140,8 +3140,8 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ } if(t2p->pdf_sample & T2P_SAMPLE_YCBCR_TO_RGB){ - TIFFError(TIFF2PDF_MODULE, - "No support for YCbCr to RGB in tile for %s", + TIFFError(TIFF2PDF_MODULE, + "No support for YCbCr to RGB in tile for %s", TIFFFileName(input)); _TIFFfree(buffer); t2p->t2p_error = T2P_ERR_ERROR; @@ -3277,15 +3277,15 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ t2p_enable(output); t2p->outputwritten = 0; bufferoffset = TIFFWriteEncodedStrip(output, (tstrip_t) 0, buffer, - TIFFStripSize(output)); + TIFFStripSize(output)); if (buffer != NULL) { _TIFFfree(buffer); buffer = NULL; } if (bufferoffset == -1) { - TIFFError(TIFF2PDF_MODULE, - "Error writing encoded tile to output PDF %s", - TIFFFileName(output)); + TIFFError(TIFF2PDF_MODULE, + "Error writing encoded tile to output PDF %s", + TIFFFileName(output)); t2p->t2p_error = T2P_ERR_ERROR; return(0); } @@ -4967,7 +4967,7 @@ tsize_t t2p_write_pdf_xobject_stream_dict(ttile_t tile, } while(0) /* - * This function writes a PDF Image XObject Colorspace name to output. + * This function writes a PDF Image XObject Colorspace name to output. */ From f840b0d2babe2bcae58bdb27d82cb518f77b2809 Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Sun, 19 Apr 2020 23:39:59 +0200 Subject: [PATCH 3/3] tiff2pdf: test the return code of TIFFReadRawStrip() and TIFFReadRawTile() --- tools/tiff2pdf.c | 67 ++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 56 insertions(+), 11 deletions(-) diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 355e8461..63e3f47b 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -2283,8 +2283,13 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ return(0); } memset(buffer, 0, t2p->tiff_datasize); - TIFFReadRawStrip(input, 0, (tdata_t) buffer, - t2p->tiff_datasize); + if (TIFFReadRawStrip(input, 0, (tdata_t) buffer, + t2p->tiff_datasize) < 0) { + TIFFError(TIFF2PDF_MODULE, + "TIFFReadRawStrip() failed"); + _TIFFfree(buffer); + return(0); + } if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ /* * make sure is lsb-to-msb @@ -2312,8 +2317,13 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ return(0); } memset(buffer, 0, t2p->tiff_datasize); - TIFFReadRawStrip(input, 0, (tdata_t) buffer, - t2p->tiff_datasize); + if (TIFFReadRawStrip(input, 0, (tdata_t) buffer, + t2p->tiff_datasize) < 0) { + TIFFError(TIFF2PDF_MODULE, + "TIFFReadRawStrip() failed"); + _TIFFfree(buffer); + return(0); + } if (t2p->tiff_fillorder==FILLORDER_LSB2MSB) { TIFFReverseBits(buffer, t2p->tiff_datasize); @@ -2419,14 +2429,22 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ bufferoffset=t2p->pdf_ojpegdatalength; stripcount=TIFFNumberOfStrips(input); for(i=0;it2p_error = T2P_ERR_ERROR; + return(0); + } + bufferoffset += retTIFFReadRawStrip; } if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){ buffer[bufferoffset++]=0xff; @@ -2489,6 +2507,13 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ memset(stripbuffer, 0, max_striplength); for(i=0;it2p_error = T2P_ERR_ERROR; + return(0); + } if(!t2p_process_jpeg_strip( stripbuffer, &striplength, @@ -2880,7 +2905,13 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ return(0); } memset(buffer, 0, t2p->tiff_datasize); - TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); + if (TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize) < 0) { + TIFFError(TIFF2PDF_MODULE, + "TIFFReadRawTile() failed"); + _TIFFfree(buffer); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ TIFFReverseBits(buffer, t2p->tiff_datasize); } @@ -2902,7 +2933,13 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ return(0); } memset(buffer, 0, t2p->tiff_datasize); - TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); + if (TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize) < 0) { + TIFFError(TIFF2PDF_MODULE, + "TIFFReadRawTile() failed"); + _TIFFfree(buffer); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ TIFFReverseBits(buffer, t2p->tiff_datasize); } @@ -2913,6 +2950,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ #endif #ifdef OJPEG_SUPPORT if(t2p->tiff_compression == COMPRESSION_OJPEG){ + tsize_t retTIFFReadRawTile; if(! t2p->pdf_ojpegdata){ TIFFError(TIFF2PDF_MODULE, "No support for OJPEG image %s with " @@ -2947,11 +2985,18 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ (t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth ) & 0xff; } } - bufferoffset=t2p->pdf_ojpegdatalength; - bufferoffset+=TIFFReadRawTile(input, + bufferoffset = t2p->pdf_ojpegdatalength; + retTIFFReadRawTile = TIFFReadRawTile(input, tile, (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), -1); + if (retTIFFReadRawTile < 0) { + TIFFError(TIFF2PDF_MODULE, "TIFFReadRawTile() failed"); + _TIFFfree(buffer); + t2p->t2p_error = T2P_ERR_ERROR; + return(0); + } + bufferoffset += retTIFFReadRawTile; ((unsigned char*)buffer)[bufferoffset++]=0xff; ((unsigned char*)buffer)[bufferoffset++]=0xd9; t2pWriteFile(output, (tdata_t) buffer, bufferoffset); @@ -2976,7 +3021,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ memset(buffer, 0, t2p->tiff_datasize); if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { if (count > 4) { - int retTIFFReadRawTile; + tsize_t retTIFFReadRawTile; /* Ignore EOI marker of JpegTables */ _TIFFmemcpy(buffer, jpt, count - 2); bufferoffset += count - 2; @@ -2985,7 +3030,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ table_end[1] = buffer[bufferoffset-1]; xuint32 = bufferoffset; bufferoffset -= 2; - retTIFFReadRawTile= TIFFReadRawTile( + retTIFFReadRawTile = TIFFReadRawTile( input, tile, (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),