fix out-of-bound read on some tiled images.
This commit is contained in:
parent
6da1fb3f64
commit
97c95667f6
@ -290,17 +290,24 @@ void
|
|||||||
TIFFReadContigTileData(TIFF* tif)
|
TIFFReadContigTileData(TIFF* tif)
|
||||||
{
|
{
|
||||||
unsigned char *buf;
|
unsigned char *buf;
|
||||||
tsize_t rowsize = TIFFTileRowSize(tif);
|
tmsize_t rowsize = TIFFTileRowSize(tif);
|
||||||
|
tmsize_t tilesize = TIFFTileSize(tif);
|
||||||
|
|
||||||
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif));
|
buf = (unsigned char *)_TIFFmalloc(tilesize);
|
||||||
if (buf) {
|
if (buf) {
|
||||||
uint32 tw, th, w, h;
|
uint32 tw=0, th=0, w=0, h=0;
|
||||||
uint32 row, col;
|
uint32 row, col;
|
||||||
|
|
||||||
TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w);
|
TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w);
|
||||||
TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h);
|
TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h);
|
||||||
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
|
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
|
||||||
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
|
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
|
||||||
|
if( rowsize == 0 || th > tilesize / rowsize )
|
||||||
|
{
|
||||||
|
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
|
||||||
|
_TIFFfree(buf);
|
||||||
|
return;
|
||||||
|
}
|
||||||
for (row = 0; row < h; row += th) {
|
for (row = 0; row < h; row += th) {
|
||||||
for (col = 0; col < w; col += tw) {
|
for (col = 0; col < w; col += tw) {
|
||||||
if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) {
|
if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) {
|
||||||
@ -318,11 +325,12 @@ void
|
|||||||
TIFFReadSeparateTileData(TIFF* tif)
|
TIFFReadSeparateTileData(TIFF* tif)
|
||||||
{
|
{
|
||||||
unsigned char *buf;
|
unsigned char *buf;
|
||||||
tsize_t rowsize = TIFFTileRowSize(tif);
|
tmsize_t rowsize = TIFFTileRowSize(tif);
|
||||||
|
tmsize_t tilesize = TIFFTileSize(tif);
|
||||||
|
|
||||||
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif));
|
buf = (unsigned char *)_TIFFmalloc(tilesize);
|
||||||
if (buf) {
|
if (buf) {
|
||||||
uint32 tw, th, w, h;
|
uint32 tw=0, th=0, w=0, h=0;
|
||||||
uint32 row, col;
|
uint32 row, col;
|
||||||
tsample_t s, samplesperpixel;
|
tsample_t s, samplesperpixel;
|
||||||
|
|
||||||
@ -331,6 +339,12 @@ TIFFReadSeparateTileData(TIFF* tif)
|
|||||||
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
|
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
|
||||||
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
|
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
|
||||||
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel);
|
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel);
|
||||||
|
if( rowsize == 0 || th > tilesize / rowsize )
|
||||||
|
{
|
||||||
|
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
|
||||||
|
_TIFFfree(buf);
|
||||||
|
return;
|
||||||
|
}
|
||||||
for (row = 0; row < h; row += th) {
|
for (row = 0; row < h; row += th) {
|
||||||
for (col = 0; col < w; col += tw) {
|
for (col = 0; col < w; col += tw) {
|
||||||
for (s = 0; s < samplesperpixel; s++) {
|
for (s = 0; s < samplesperpixel; s++) {
|
||||||
|
Loading…
Reference in New Issue
Block a user