From 9d862966e6613843e118b87e8058ee87f6491e84 Mon Sep 17 00:00:00 2001 From: Frank Warmerdam Date: Tue, 17 Oct 2000 02:33:52 +0000 Subject: [PATCH] Avoid overwriting end of output buffer in PackBitsDecode(). --- libtiff/tif_packbits.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/libtiff/tif_packbits.c b/libtiff/tif_packbits.c index 9447aba2..67830595 100644 --- a/libtiff/tif_packbits.c +++ b/libtiff/tif_packbits.c @@ -1,4 +1,4 @@ -/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.1 1999-07-27 21:50:27 mike Exp $ */ +/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.2 2000-10-17 02:33:52 warmerda Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -222,13 +222,28 @@ PackBitsDecode(TIFF* tif, tidata_t op, tsize_t occ, tsample_t s) if (n < 0) { /* replicate next byte -n+1 times */ if (n == -128) /* nop */ continue; - n = -n + 1; + n = -n + 1; + if( occ < n ) + { + TIFFWarning("PackbitsDecode", + "%s: discarding data to " + "avoid buffer overrun", + tif->tif_name ); + } occ -= n; b = *bp++, cc--; while (n-- > 0) *op++ = b; } else { /* copy next n+1 bytes literally */ - _TIFFmemcpy(op, bp, ++n); + if (occ < n + 1) + { + TIFFWarning("PackbitsDecode", + "%s: discarding data to " + "avoid buffer overrun", + tif->tif_name ); + n = occ - 1; + } + _TIFFmemcpy(op, bp, ++n); op += n; occ -= n; bp += n; cc -= n; }