cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid overwriting end of output buffer in PackBitsDecode().

Browse Source
This commit is contained in:
Frank Warmerdam 2000-10-17 02:33:52 +00:00
parent 4e0075f4cb
commit 9d862966e6
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libtiff/tif_packbits.c
View File

@ -1,4 +1,4 @@
/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.1 1999-07-27 21:50:27 mike Exp $ */ /* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_packbits.c,v 1.2 2000-10-17 02:33:52 warmerda Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -223,11 +223,26 @@ PackBitsDecode(TIFF* tif, tidata_t op, tsize_t occ, tsample_t s)
if (n == -128) /* nop */ if (n == -128) /* nop */
continue; continue;
n = -n + 1; n = -n + 1;
if( occ < n )
{
TIFFWarning("PackbitsDecode",
"%s: discarding data to "
"avoid buffer overrun",
tif->tif_name );
}
occ -= n; occ -= n;
b = *bp++, cc--; b = *bp++, cc--;
while (n-- > 0) while (n-- > 0)
*op++ = b; *op++ = b;
} else { /* copy next n+1 bytes literally */ } else { /* copy next n+1 bytes literally */
if (occ < n + 1)
{
TIFFWarning("PackbitsDecode",
"%s: discarding data to "
"avoid buffer overrun",
tif->tif_name );
n = occ - 1;
}
_TIFFmemcpy(op, bp, ++n); _TIFFmemcpy(op, bp, ++n);
op += n; occ -= n; op += n; occ -= n;
bp += n; cc -= n; bp += n; cc -= n;