From 19ff8a6e97bab4cd558a95bf45d03400cbbe5187 Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Tue, 10 Nov 2020 03:00:12 +0100 Subject: [PATCH 1/2] fix undefined behaviour (int shifted too much to the left) --- tools/tiff2ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c index 73e6ca4c..0849c121 100644 --- a/tools/tiff2ps.c +++ b/tools/tiff2ps.c @@ -3048,7 +3048,7 @@ tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw tsize_t len; /* Output this many bytes */ len = raw_l + 1; - val32 = *++raw_p << 24; /* Prime the pump */ + val32 = (uint32)*++raw_p << 24; /* Prime the pump */ if ( --raw_l > 0 ) val32 += *(++raw_p) << 16; if ( --raw_l > 0 ) val32 += *(++raw_p) << 8; From b7cc4f7ef182e740e6187657993afe81c21b9833 Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Tue, 10 Nov 2020 03:00:27 +0100 Subject: [PATCH 2/2] tiff2ps.c: fix buffer overread fixes #193 --- tools/tiff2ps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c index 0849c121..4ed5eba2 100644 --- a/tools/tiff2ps.c +++ b/tools/tiff2ps.c @@ -2715,7 +2715,7 @@ PSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h) #if defined( EXP_ASCII85ENCODER ) if (alpha) { int adjust, i; - for (i = 0; i < cc; i+=2) { + for (i = 0; i < (cc - 1); i+=2) { adjust = 255 - cp[i + 1]; cp[i / 2] = cp[i] + adjust; }