cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid overwriting end of output buffer in PackBitsDecode().

Browse Source
This commit is contained in:
Frank Warmerdam 2000-10-17 02:33:52 +00:00
parent 4e0075f4cb
commit 9d862966e6
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libtiff/tif_packbits.c
View File

@ -1,4 +1,4 @@
/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.1 1999-07-27 21:50:27 mike Exp $ */
/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.2 2000-10-17 02:33:52 warmerda Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -222,13 +222,28 @@ PackBitsDecode(TIFF* tif, tidata_t op, tsize_t occ, tsample_t s)
if (n < 0) { /* replicate next byte -n+1 times */
if (n == -128) /* nop */
continue;
n = -n + 1;
n = -n + 1;
if( occ < n )
{
TIFFWarning("PackbitsDecode",
"%s: discarding data to "
"avoid buffer overrun",
tif->tif_name );
}
occ -= n;
b = *bp++, cc--;
while (n-- > 0)
*op++ = b;
} else { /* copy next n+1 bytes literally */
_TIFFmemcpy(op, bp, ++n);
if (occ < n + 1)
{
TIFFWarning("PackbitsDecode",
"%s: discarding data to "
"avoid buffer overrun",
tif->tif_name );
n = occ - 1;
}
_TIFFmemcpy(op, bp, ++n);
op += n; occ -= n;
bp += n; cc -= n;
}