cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TIFFFillStrip(): avoid harmless unsigned integer overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16653

Browse Source
This commit is contained in:
Even Rouault 2019-08-23 14:54:26 +02:00
parent ea271d7434
commit 67f7561e70
No known key found for this signature in database
GPG Key ID: 33EBBFC47B3DD87D
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libtiff/tif_read.c
View File

@ -735,6 +735,12 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module)); return (TIFFReadRawStrip1(tif, strip, buf, bytecountm, module));
} }
TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
static uint64 NoSantizeSubUInt64(uint64 a, uint64 b)
{
return a - b;
}
/* /*
* Read the specified strip and setup for decoding. The data buffer is * Read the specified strip and setup for decoding. The data buffer is
* expanded, as necessary, to hold the strip's data. * expanded, as necessary, to hold the strip's data.
@ -818,7 +824,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
"Read error on strip %lu; " "Read error on strip %lu; "
"got %I64u bytes, expected %I64u", "got %I64u bytes, expected %I64u",
(unsigned long) strip, (unsigned long) strip,
(unsigned __int64) tif->tif_size - TIFFGetStrileOffset(tif, strip), (unsigned __int64) NoSantizeSubUInt64(tif->tif_size, TIFFGetStrileOffset(tif, strip)),
(unsigned __int64) bytecount); (unsigned __int64) bytecount);
#else #else
TIFFErrorExt(tif->tif_clientdata, module, TIFFErrorExt(tif->tif_clientdata, module,
@ -826,7 +832,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
"Read error on strip %lu; " "Read error on strip %lu; "
"got %llu bytes, expected %llu", "got %llu bytes, expected %llu",
(unsigned long) strip, (unsigned long) strip,
(unsigned long long) tif->tif_size - TIFFGetStrileOffset(tif, strip), (unsigned long long) NoSantizeSubUInt64(tif->tif_size, TIFFGetStrileOffset(tif, strip)),
(unsigned long long) bytecount); (unsigned long long) bytecount);
#endif #endif
tif->tif_curstrip = NOSTRIP; tif->tif_curstrip = NOSTRIP;