cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tiffcrop: fix buffer overrun in extractContigSamples24bits()

Browse Source 
fixes #113
This commit is contained in:
Thomas Bernard 2020-11-18 01:47:11 +01:00
parent dadd8c7dce
commit 916c1a4f8b
No known key found for this signature in database
GPG Key ID: DB511043A31ACAAF
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tools/tiffcrop.c
View File

@ -3035,9 +3035,25 @@ extractContigSamples24bits (uint8 *in, uint8 *out, uint32 cols,
src = in + src_byte; src = in + src_byte;
matchbits = maskbits << (32 - src_bit - bps); matchbits = maskbits << (32 - src_bit - bps);
if (little_endian) if (little_endian)
buff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3]; {
buff1 = (src[0] << 24);
if (matchbits & 0x00ff0000)
buff1 |= (src[1] << 16);
if (matchbits & 0x0000ff00)
buff1 |= (src[2] << 8);
if (matchbits & 0x000000ff)
buff1 |= src[3];
}
else else
buff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0]; {
buff1 = src[0];
if (matchbits & 0x0000ff00)
buff1 |= (src[1] << 8);
if (matchbits & 0x00ff0000)
buff1 |= (src[2] << 16);
if (matchbits & 0xff000000)
buff1 |= (src[3] << 24);
}
buff1 = (buff1 & matchbits) << (src_bit); buff1 = (buff1 & matchbits) << (src_bit);
if (ready_bits < 16) /* add another bps bits to the buffer */ if (ready_bits < 16) /* add another bps bits to the buffer */