cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer

Browse Source 
addition in TIFFReadRawStrip1() in isMapped() case.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
This commit is contained in:
Even Rouault 2017-01-11 16:33:34 +00:00
parent 153418c943
commit 50b48786d5
2 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-01-11 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer
addition in TIFFReadRawStrip1() in isMapped() case.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
2017-01-11 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_jpeg.c: validate BitsPerSample in JPEGSetupEncode() to avoid

29
libtiff/tif_read.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_read.c,v 1.50 2016-12-02 21:56:56 erouault Exp $ */
/* $Id: tif_read.c,v 1.51 2017-01-11 16:33:34 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size,
return ((tmsize_t)(-1));
}
} else {
tmsize_t ma,mb;
tmsize_t ma;
tmsize_t n;
ma=(tmsize_t)td->td_stripoffset[strip];
mb=ma+size;
if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size))
n=0;
else if ((mb<ma)||(mb<size)||(mb>tif->tif_size))
n=tif->tif_size-ma;
else
n=size;
if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||
((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size))
{
n=0;
}
else if( ma > TIFF_TMSIZE_T_MAX - size )
{
n=0;
}
else
{
tmsize_t mb=ma+size;
if (mb>tif->tif_size)
n=tif->tif_size-ma;
else
n=size;
}
if (n!=size) {
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
TIFFErrorExt(tif->tif_clientdata, module,