cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix out-of-bound read on some tiled images.

Browse Source
This commit is contained in:
Young_X 2018-09-08 15:07:53 +08:00
parent 6da1fb3f64
commit 97c95667f6
1 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
tools/tiffinfoce.c
View File

@ -290,17 +290,24 @@ void
TIFFReadContigTileData(TIFF* tif) TIFFReadContigTileData(TIFF* tif)
{ {
unsigned char *buf; unsigned char *buf;
tsize_t rowsize = TIFFTileRowSize(tif); tmsize_t rowsize = TIFFTileRowSize(tif);
tmsize_t tilesize = TIFFTileSize(tif);
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); buf = (unsigned char *)_TIFFmalloc(tilesize);
if (buf) { if (buf) {
uint32 tw, th, w, h; uint32 tw=0, th=0, w=0, h=0;
uint32 row, col; uint32 row, col;
TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w); TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w);
TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h); TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h);
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
if( rowsize == 0 || th > tilesize / rowsize )
{
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
_TIFFfree(buf);
return;
}
for (row = 0; row < h; row += th) { for (row = 0; row < h; row += th) {
for (col = 0; col < w; col += tw) { for (col = 0; col < w; col += tw) {
if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) { if (TIFFReadTile(tif, buf, col, row, 0, 0) < 0) {
@ -318,11 +325,12 @@ void
TIFFReadSeparateTileData(TIFF* tif) TIFFReadSeparateTileData(TIFF* tif)
{ {
unsigned char *buf; unsigned char *buf;
tsize_t rowsize = TIFFTileRowSize(tif); tmsize_t rowsize = TIFFTileRowSize(tif);
tmsize_t tilesize = TIFFTileSize(tif);
buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif)); buf = (unsigned char *)_TIFFmalloc(tilesize);
if (buf) { if (buf) {
uint32 tw, th, w, h; uint32 tw=0, th=0, w=0, h=0;
uint32 row, col; uint32 row, col;
tsample_t s, samplesperpixel; tsample_t s, samplesperpixel;
@ -331,6 +339,12 @@ TIFFReadSeparateTileData(TIFF* tif)
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw); TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th); TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel); TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel);
if( rowsize == 0 || th > tilesize / rowsize )
{
fprintf(stderr, "Cannot display data: th * rowsize > tilesize\n");
_TIFFfree(buf);
return;
}
for (row = 0; row < h; row += th) { for (row = 0; row < h; row += th) {
for (col = 0; col < w; col += tw) { for (col = 0; col < w; col += tw) {
for (s = 0; s < samplesperpixel; s++) { for (s = 0; s < samplesperpixel; s++) {