cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in

Browse Source 
readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer.
Reported by Agostina Sarubo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2621
This commit is contained in:
Even Rouault 2016-12-03 12:19:32 +00:00
parent 3a1c5ac67b
commit 7aad042fc8
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2016-12-03 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in
readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer.
Reported by Agostina Sarubo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2621
2016-12-03 Even Rouault <even.rouault at spatialys.com>
* tools/tiffcrop.c: fix readContigStripsIntoBuffer() in -i (ignore) mode so

14
tools/tiffcrop.c
View File

@ -1,4 +1,4 @@
/* $Id: tiffcrop.c,v 1.47 2016-12-03 11:35:56 erouault Exp $ */
/* $Id: tiffcrop.c,v 1.48 2016-12-03 12:19:32 erouault Exp $ */
/* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of
* the image data through additional options listed below
@ -4815,10 +4815,17 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
nstrips = TIFFNumberOfStrips(in);
strips_per_sample = nstrips /spp;
/* Add 3 padding bytes for combineSeparateSamples32bits */
if( (size_t) stripsize > 0xFFFFFFFFU - 3U )
{
TIFFError("readSeparateStripsIntoBuffer", "Integer overflow when calculating buffer size.");
exit(-1);
}
for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
{
srcbuffs[s] = NULL;
buff = _TIFFmalloc(stripsize);
buff = _TIFFmalloc(stripsize + 3);
if (!buff)
{
TIFFError ("readSeparateStripsIntoBuffer",
@ -4827,6 +4834,9 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
_TIFFfree (srcbuffs[i]);
return 0;
}
buff[stripsize] = 0;
buff[stripsize+1] = 0;
buff[stripsize+2] = 0;
srcbuffs[s] = buff;
}