cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-193' into 'master'

Browse Source 
fix buffer overflow in tiff2ps.c

Closes #193

See merge request libtiff/libtiff!162
This commit is contained in:
Even Rouault 2020-11-14 12:50:05 +00:00
commit 7ade760d79
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/tiff2ps.c
View File

@ -2715,7 +2715,7 @@ PSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h)
#if defined( EXP_ASCII85ENCODER ) #if defined( EXP_ASCII85ENCODER )
if (alpha) { if (alpha) {
int adjust, i; int adjust, i;
for (i = 0; i < cc; i+=2) { for (i = 0; i < (cc - 1); i+=2) {
adjust = 255 - cp[i + 1]; adjust = 255 - cp[i + 1];
cp[i / 2] = cp[i] + adjust; cp[i / 2] = cp[i] + adjust;
} }
@ -3048,7 +3048,7 @@ tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw
tsize_t len; /* Output this many bytes */ tsize_t len; /* Output this many bytes */
len = raw_l + 1; len = raw_l + 1;
val32 = *++raw_p << 24; /* Prime the pump */ val32 = (uint32)*++raw_p << 24; /* Prime the pump */
if ( --raw_l > 0 ) val32 += *(++raw_p) << 16; if ( --raw_l > 0 ) val32 += *(++raw_p) << 16;
if ( --raw_l > 0 ) val32 += *(++raw_p) << 8; if ( --raw_l > 0 ) val32 += *(++raw_p) << 8;