cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_packbits.c: fix out-of-buffer read in PackBitsDecode()

Browse Source 
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
Credit to OSS-Fuzz
This commit is contained in:
Even Rouault 2017-05-14 02:26:07 +00:00
parent 99e8fb373e
commit 8d4e459102
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-05-14 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_packbits.c: fix out-of-buffer read in PackBitsDecode()
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1563
Credit to OSS-Fuzz
2017-05-13 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_pixarlog.c, tif_luv.c: avoid potential int32

8
libtiff/tif_packbits.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_packbits.c,v 1.25 2017-01-11 20:33:35 erouault Exp $ */
/* $Id: tif_packbits.c,v 1.26 2017-05-14 02:26:07 erouault Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -244,6 +244,12 @@ PackBitsDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
(unsigned long) ((tmsize_t)n - occ));
n = (long)occ;
}
if( cc == 0 )
{
TIFFWarningExt(tif->tif_clientdata, module,
"Terminating PackBitsDecode due to lack of data.");
break;
}
occ -= n;
b = *bp++;
cc--;