cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-176' into 'master'

Browse Source 
tiff2pdf: get rid of uninitialized memory content

Closes #176

See merge request libtiff/libtiff!143
This commit is contained in:
Even Rouault 2020-04-24 19:16:06 +00:00
commit 400ae6f2b1
1 changed files with 135 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
tools/tiff2pdf.c
View File

@ -2282,8 +2282,14 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
TIFFReadRawStrip(input, 0, (tdata_t) buffer, memset(buffer, 0, t2p->tiff_datasize);
t2p->tiff_datasize); if (TIFFReadRawStrip(input, 0, (tdata_t) buffer,
t2p->tiff_datasize) < 0) {
TIFFError(TIFF2PDF_MODULE,
"TIFFReadRawStrip() failed");
_TIFFfree(buffer);
return(0);
}
if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){
/* /*
* make sure is lsb-to-msb * make sure is lsb-to-msb
@ -2311,8 +2317,13 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize); memset(buffer, 0, t2p->tiff_datasize);
TIFFReadRawStrip(input, 0, (tdata_t) buffer, if (TIFFReadRawStrip(input, 0, (tdata_t) buffer,
t2p->tiff_datasize); t2p->tiff_datasize) < 0) {
TIFFError(TIFF2PDF_MODULE,
"TIFFReadRawStrip() failed");
_TIFFfree(buffer);
return(0);
}
if (t2p->tiff_fillorder==FILLORDER_LSB2MSB) { if (t2p->tiff_fillorder==FILLORDER_LSB2MSB) {
TIFFReverseBits(buffer, TIFFReverseBits(buffer,
t2p->tiff_datasize); t2p->tiff_datasize);
@ -2418,14 +2429,22 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
bufferoffset=t2p->pdf_ojpegdatalength; bufferoffset=t2p->pdf_ojpegdatalength;
stripcount=TIFFNumberOfStrips(input); stripcount=TIFFNumberOfStrips(input);
for(i=0;i<stripcount;i++){ for(i=0;i<stripcount;i++){
tsize_t retTIFFReadRawStrip;
if(i != 0){ if(i != 0){
buffer[bufferoffset++]=0xff; buffer[bufferoffset++]=0xff;
buffer[bufferoffset++]=(0xd0 | ((i-1)%8)); buffer[bufferoffset++]=(0xd0 | ((i-1)%8));
} }
bufferoffset+=TIFFReadRawStrip(input, retTIFFReadRawStrip = TIFFReadRawStrip(input,
i, i,
(tdata_t) &(((unsigned char*)buffer)[bufferoffset]), (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
-1); -1);
if (retTIFFReadRawStrip < 0) {
TIFFError(TIFF2PDF_MODULE, "TIFFReadRawStrip()");
_TIFFfree(buffer);
t2p->t2p_error = T2P_ERR_ERROR;
return(0);
}
bufferoffset += retTIFFReadRawStrip;
} }
if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){ if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){
buffer[bufferoffset++]=0xff; buffer[bufferoffset++]=0xff;
@ -2485,8 +2504,16 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(stripbuffer, 0, max_striplength);
for(i=0;i<stripcount;i++){ for(i=0;i<stripcount;i++){
striplength=TIFFReadRawStrip(input, i, (tdata_t) stripbuffer, -1); striplength=TIFFReadRawStrip(input, i, (tdata_t) stripbuffer, -1);
if (striplength < 0) {
TIFFError(TIFF2PDF_MODULE, "TIFFReadRawStrip() failed");
_TIFFfree(samplebuffer);
_TIFFfree(buffer);
t2p->t2p_error = T2P_ERR_ERROR;
return(0);
}
if(!t2p_process_jpeg_strip( if(!t2p_process_jpeg_strip(
stripbuffer, stripbuffer,
&striplength, &striplength,
@ -2877,7 +2904,14 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); memset(buffer, 0, t2p->tiff_datasize);
if (TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize) < 0) {
TIFFError(TIFF2PDF_MODULE,
"TIFFReadRawTile() failed");
_TIFFfree(buffer);
t2p->t2p_error = T2P_ERR_ERROR;
return(0);
}
if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){
TIFFReverseBits(buffer, t2p->tiff_datasize); TIFFReverseBits(buffer, t2p->tiff_datasize);
} }
@ -2898,7 +2932,14 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize); memset(buffer, 0, t2p->tiff_datasize);
if (TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize) < 0) {
TIFFError(TIFF2PDF_MODULE,
"TIFFReadRawTile() failed");
_TIFFfree(buffer);
t2p->t2p_error = T2P_ERR_ERROR;
return(0);
}
if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){ if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){
TIFFReverseBits(buffer, t2p->tiff_datasize); TIFFReverseBits(buffer, t2p->tiff_datasize);
} }
@ -2909,6 +2950,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
#endif #endif
#ifdef OJPEG_SUPPORT #ifdef OJPEG_SUPPORT
if(t2p->tiff_compression == COMPRESSION_OJPEG){ if(t2p->tiff_compression == COMPRESSION_OJPEG){
tsize_t retTIFFReadRawTile;
if(! t2p->pdf_ojpegdata){ if(! t2p->pdf_ojpegdata){
TIFFError(TIFF2PDF_MODULE, TIFFError(TIFF2PDF_MODULE,
"No support for OJPEG image %s with " "No support for OJPEG image %s with "
@ -2927,6 +2969,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize);
_TIFFmemcpy(buffer, t2p->pdf_ojpegdata, t2p->pdf_ojpegdatalength); _TIFFmemcpy(buffer, t2p->pdf_ojpegdata, t2p->pdf_ojpegdatalength);
if(edge!=0){ if(edge!=0){
if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile)){ if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile)){
@ -2943,10 +2986,17 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
} }
} }
bufferoffset = t2p->pdf_ojpegdatalength; bufferoffset = t2p->pdf_ojpegdatalength;
bufferoffset+=TIFFReadRawTile(input, retTIFFReadRawTile = TIFFReadRawTile(input,
tile, tile,
(tdata_t) &(((unsigned char*)buffer)[bufferoffset]), (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
-1); -1);
if (retTIFFReadRawTile < 0) {
TIFFError(TIFF2PDF_MODULE, "TIFFReadRawTile() failed");
_TIFFfree(buffer);
t2p->t2p_error = T2P_ERR_ERROR;
return(0);
}
bufferoffset += retTIFFReadRawTile;
((unsigned char*)buffer)[bufferoffset++]=0xff; ((unsigned char*)buffer)[bufferoffset++]=0xff;
((unsigned char*)buffer)[bufferoffset++]=0xd9; ((unsigned char*)buffer)[bufferoffset++]=0xd9;
t2pWriteFile(output, (tdata_t) buffer, bufferoffset); t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
@ -2968,9 +3018,10 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize);
if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
if (count > 4) { if (count > 4) {
int retTIFFReadRawTile; tsize_t retTIFFReadRawTile;
/* Ignore EOI marker of JpegTables */ /* Ignore EOI marker of JpegTables */
_TIFFmemcpy(buffer, jpt, count - 2); _TIFFmemcpy(buffer, jpt, count - 2);
bufferoffset += count - 2; bufferoffset += count - 2;
@ -3016,6 +3067,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize);
read = TIFFReadEncodedTile( read = TIFFReadEncodedTile(
input, input,
@ -3049,6 +3101,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize);
samplebuffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize); samplebuffer = (unsigned char*) _TIFFmalloc(t2p->tiff_datasize);
if(samplebuffer==NULL){ if(samplebuffer==NULL){
TIFFError(TIFF2PDF_MODULE, TIFFError(TIFF2PDF_MODULE,
@ -3060,6 +3113,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(samplebuffer, 0, t2p->tiff_datasize);
samplebufferoffset=0; samplebufferoffset=0;
for(i=0;i<t2p->tiff_samplesperpixel;i++){ for(i=0;i<t2p->tiff_samplesperpixel;i++){
read = read =
@ -3099,6 +3153,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
t2p->t2p_error = T2P_ERR_ERROR; t2p->t2p_error = T2P_ERR_ERROR;
return(0); return(0);
} }
memset(buffer, 0, t2p->tiff_datasize);
read = TIFFReadEncodedTile( read = TIFFReadEncodedTile(
input, input,
tile, tile,