cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-113' into 'master'

Browse Source 
tiffcrop: fix buffer overrun in extractContigSamples24bits()

Closes #113

See merge request libtiff/libtiff!169
This commit is contained in:
Even Rouault 2020-11-21 17:35:18 +00:00
commit 9dce07a777
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tools/tiffcrop.c
View File

@ -3035,9 +3035,25 @@ extractContigSamples24bits (uint8 *in, uint8 *out, uint32 cols,
src = in + src_byte; src = in + src_byte;
matchbits = maskbits << (32 - src_bit - bps); matchbits = maskbits << (32 - src_bit - bps);
if (little_endian) if (little_endian)
buff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3]; {
buff1 = (src[0] << 24);
if (matchbits & 0x00ff0000)
buff1 |= (src[1] << 16);
if (matchbits & 0x0000ff00)
buff1 |= (src[2] << 8);
if (matchbits & 0x000000ff)
buff1 |= src[3];
}
else else
buff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0]; {
buff1 = src[0];
if (matchbits & 0x0000ff00)
buff1 |= (src[1] << 8);
if (matchbits & 0x00ff0000)
buff1 |= (src[2] << 16);
if (matchbits & 0xff000000)
buff1 |= (src[3] << 24);
}
buff1 = (buff1 & matchbits) << (src_bit); buff1 = (buff1 & matchbits) << (src_bit);
if (ready_bits < 16) /* add another bps bits to the buffer */ if (ready_bits < 16) /* add another bps bits to the buffer */