cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* contrib/addtiffo/tif_overview.c (TIFF_DownSample): Check buffer

Browse Source 
size calculation for overflow.
This commit is contained in:
Bob Friesenhahn 2015-05-30 21:13:39 +00:00
parent 2b221734c6
commit 9626bb6db9
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,5 +1,8 @@
2015-05-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> 2015-05-30 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
* contrib/addtiffo/tif_overview.c (TIFF_DownSample): Check buffer
size calculation for overflow.
* contrib/addtiffo/addtiffo.c (main): Possibly address Coverity * contrib/addtiffo/addtiffo.c (main): Possibly address Coverity
1024226 "Untrusted value as argument". 1024226 "Untrusted value as argument".

21
contrib/addtiffo/tif_overview.c
View File

@ -272,10 +272,27 @@ void TIFF_DownSample( unsigned char *pabySrcTile,
int nPixelGroupBytes = (nBitsPerPixel+nPixelSkewBits)/8; int nPixelGroupBytes = (nBitsPerPixel+nPixelSkewBits)/8;
unsigned char *pabySrc, *pabyDst; unsigned char *pabySrc, *pabyDst;
double *padfSamples; double *padfSamples;
size_t tpadfSamples_size, padfSamples_size;
assert( nBitsPerPixel >= 8 ); assert( nBitsPerPixel >= 8 );
padfSamples = (double *) malloc(sizeof(double) * nOMult * nOMult); /* sizeof(double) * nOMult * nOMult */
tpadfSamples_size=nOMult*nOMult;
if ((nOMult != 0) && (tpadfSamples_size/nOMult == (size_t) nOMult)) {
padfSamples_size=tpadfSamples_size;
tpadfSamples_size=padfSamples_size*sizeof(double);
if ((tpadfSamples_size / padfSamples_size) == sizeof(double))
padfSamples_size=tpadfSamples_size;
else
padfSamples_size=0;
} else {
padfSamples_size=0;
}
if (padfSamples_size == 0) {
/* TODO: This is an error condition */
return;
}
padfSamples = (double *) malloc(padfSamples_size);
/* ==================================================================== */ /* ==================================================================== */
/* Loop over scanline chunks to process, establishing where the */ /* Loop over scanline chunks to process, establishing where the */
@ -893,7 +910,7 @@ void TIFFBuildOverviews( TIFF *hTIFF, int nOverviews, int * panOvList,
/* /*
* Local Variables: * Local Variables:
* mode: c * mode: c
* c-basic-offset: 8 * c-basic-offset: 4
* fill-column: 78 * fill-column: 78
* End: * End:
*/ */