cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* contrib/addtiffo/tif_overview.c (TIFF_DownSample): Check buffer

Browse Source 
size calculation for overflow.
This commit is contained in:
Bob Friesenhahn 2015-05-30 21:13:39 +00:00
parent 2b221734c6
commit 9626bb6db9
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,5 +1,8 @@
2015-05-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
* contrib/addtiffo/tif_overview.c (TIFF_DownSample): Check buffer
size calculation for overflow.
* contrib/addtiffo/addtiffo.c (main): Possibly address Coverity
1024226 "Untrusted value as argument".

21
contrib/addtiffo/tif_overview.c
View File

@ -272,10 +272,27 @@ void TIFF_DownSample( unsigned char *pabySrcTile,
int nPixelGroupBytes = (nBitsPerPixel+nPixelSkewBits)/8;
unsigned char *pabySrc, *pabyDst;
double *padfSamples;
size_t tpadfSamples_size, padfSamples_size;
assert( nBitsPerPixel >= 8 );
padfSamples = (double *) malloc(sizeof(double) * nOMult * nOMult);
/* sizeof(double) * nOMult * nOMult */
tpadfSamples_size=nOMult*nOMult;
if ((nOMult != 0) && (tpadfSamples_size/nOMult == (size_t) nOMult)) {
padfSamples_size=tpadfSamples_size;
tpadfSamples_size=padfSamples_size*sizeof(double);
if ((tpadfSamples_size / padfSamples_size) == sizeof(double))
padfSamples_size=tpadfSamples_size;
else
padfSamples_size=0;
} else {
padfSamples_size=0;
}
if (padfSamples_size == 0) {
/* TODO: This is an error condition */
return;
}
padfSamples = (double *) malloc(padfSamples_size);
/* ==================================================================== */
/* Loop over scanline chunks to process, establishing where the */
@ -893,7 +910,7 @@ void TIFFBuildOverviews( TIFF *hTIFF, int nOverviews, int * panOvList,
/*
* Local Variables:
* mode: c
* c-basic-offset: 8
* c-basic-offset: 4
* fill-column: 78
* End:
*/