cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Several buffer overruns fixed, as noted by Chris Evans.

Browse Source
This commit is contained in:
Andrey Kiselev 2004-09-19 10:08:38 +00:00
parent eca092d8d3
commit 8eb1504c33
3 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libtiff/tif_luv.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_luv.c,v 1.10 2004-09-14 06:02:56 dron Exp $ */
/* $Id: tif_luv.c,v 1.11 2004-09-19 10:08:38 dron Exp $ */
/*
* Copyright (c) 1997 Greg Ward Larson
@ -214,11 +214,11 @@ LogL16Decode(TIFF* tif, tidata_t op, tsize_t occ, tsample_t s)
rc = *bp++ + (2-128);
b = (int16)(*bp++ << shft);
cc -= 2;
while (rc--)
while (rc-- && i < npixels)
tp[i++] |= b;
} else { /* non-run */
rc = *bp++; /* nul is noop */
while (--cc && rc--)
while (--cc && rc-- && i < npixels)
tp[i++] |= (int16)*bp++ << shft;
}
if (i != npixels) {
@ -314,11 +314,11 @@ LogLuvDecode32(TIFF* tif, tidata_t op, tsize_t occ, tsample_t s)
rc = *bp++ + (2-128);
b = (uint32)*bp++ << shft;
cc -= 2;
while (rc--)
while (rc-- && i < npixels)
tp[i++] |= b;
} else { /* non-run */
rc = *bp++; /* nul is noop */
while (--cc && rc--)
while (--cc && rc-- && i < npixels)
tp[i++] |= (uint32)*bp++ << shft;
}
if (i != npixels) {

6
libtiff/tif_next.c
View File

@ -1,4 +1,4 @@
/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_next.c,v 1.3 2003-07-08 16:40:46 warmerda Exp $ */
/* $Id: tif_next.c,v 1.4 2004-09-19 10:08:38 dron Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -87,7 +87,7 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
*/
off = (bp[0] * 256) + bp[1];
n = (bp[2] * 256) + bp[3];
if (cc < 4+n)
if (cc < 4+n || off+n > scanline)
goto bad;
_TIFFmemcpy(row+off, bp+4, n);
bp += 4+n;
@ -140,3 +140,5 @@ TIFFInitNeXT(TIFF* tif, int scheme)
return (1);
}
#endif /* NEXT_SUPPORT */
/* vim: set ts=8 sts=8 sw=8 noet: */

8
libtiff/tif_thunder.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_thunder.c,v 1.3 2004-09-14 06:42:55 dron Exp $ */
/* $Id: tif_thunder.c,v 1.4 2004-09-19 10:08:38 dron Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -91,8 +91,10 @@ ThunderDecode(TIFF* tif, tidata_t op, tsize_t maxpixels)
} else
lastpixel |= lastpixel << 4;
npixels += n;
for (; n > 0; n -= 2)
*op++ = (tidataval_t) lastpixel;
if (npixels < maxpixels) {
for (; n > 0; n -= 2)
*op++ = (tidataval_t) lastpixel;
}
if (n == -1)
*--op &= 0xf0;
lastpixel &= 0xf;