cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

back out patch from #2065 and apply patch from #1085 for a better underflow fix that errors properly.

Browse Source
This commit is contained in:
Frank Warmerdam 2009-06-30 04:15:24 +00:00
parent 1517c5cd8f
commit 54600ed574
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2009-06-30 Frank Warmerdam <warmerdam@pobox.com>
* libtiff/tif_lzw.c: back out patch from #2065 and apply patch from
#1085 for a better underflow fix that errors properly.
http://bugzilla.maptools.org/show_bug.cgi?id=2065
http://bugzilla.maptools.org/show_bug.cgi?id=1985
2009-06-26 Frank Warmerdam <warmerdam@pobox.com>
* libtiff/tif_strip.c: Remove an inappropriate assertion that often

9
libtiff/tif_lzw.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_lzw.c,v 1.40 2009-06-22 04:47:12 fwarmerdam Exp $ */
/* $Id: tif_lzw.c,v 1.41 2009-06-30 04:15:24 fwarmerdam Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -437,7 +437,7 @@ LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
NextCode(tif, sp, bp, code, GetNextCode);
if (code == CODE_EOI)
break;
if (code == CODE_CLEAR) {
if (code >= CODE_CLEAR) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
"LZWDecode: Corrupted LZW table at scanline %d",
tif->tif_row);
@ -649,7 +649,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
NextCode(tif, sp, bp, code, GetNextCodeCompat);
if (code == CODE_EOI)
break;
if (code == CODE_CLEAR) {
if (code >= CODE_CLEAR) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
"LZWDecode: Corrupted LZW table at scanline %d",
tif->tif_row);
@ -690,7 +690,6 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
}
oldcodep = codep;
if (code >= 256) {
char *op_orig = op;
/*
* Code maps to a string, copy string
* value to output (written in reverse).
@ -726,7 +725,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
tp = op;
do {
*--tp = codep->value;
} while( (codep = codep->next) != NULL && tp > op_orig);
} while( (codep = codep->next) != NULL );
} else
*op++ = code, occ--;
}