cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_luv.c: further reduce memory requirements for temporary

Browse Source 
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
LogL16InitState().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
Credit to OSS Fuzz
This commit is contained in:
Even Rouault 2017-07-24 12:47:30 +00:00
parent 06155116f6
commit 8ad1c70dc1
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2017-07-24 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_luv.c: further reduce memory requirements for temporary
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
LogL16InitState().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
Credit to OSS Fuzz
2017-07-24 Even Rouault <even.rouault at spatialys.com> 2017-07-24 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_getimage.c: fix fromskew computation when to-be-skipped * libtiff/tif_getimage.c: fix fromskew computation when to-be-skipped

6
libtiff/tif_luv.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_luv.c,v 1.48 2017-07-18 19:45:12 erouault Exp $ */ /* $Id: tif_luv.c,v 1.49 2017-07-24 12:47:30 erouault Exp $ */
/* /*
* Copyright (c) 1997 Greg Ward Larson * Copyright (c) 1997 Greg Ward Larson
@ -1314,7 +1314,7 @@ LogL16InitState(TIFF* tif)
} }
if( isTiled(tif) ) if( isTiled(tif) )
sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength); sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength);
else if( td->td_rowsperstrip != (uint32)-1 ) else if( td->td_rowsperstrip < td->td_imagelength )
sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip); sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip);
else else
sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength); sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength);
@ -1416,7 +1416,7 @@ LogLuvInitState(TIFF* tif)
} }
if( isTiled(tif) ) if( isTiled(tif) )
sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength); sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength);
else if( td->td_rowsperstrip != (uint32)-1 ) else if( td->td_rowsperstrip < td->td_imagelength )
sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip); sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip);
else else
sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength); sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength);