cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedRational, replace

Browse Source 
assertion by runtime check to error out if passed value is strictly
negative.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2535

* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that
caused double free.
Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535
This commit is contained in:
Even Rouault 2017-01-11 12:51:59 +00:00
parent 20dd00743c
commit 9f839d9233
3 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2017-01-11 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedRational, replace
assertion by runtime check to error out if passed value is strictly
negative.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2535
* tools/tiffcrop.c: remove extraneous TIFFClose() in error code path, that
caused double free.
Related to http://bugzilla.maptools.org/show_bug.cgi?id=2535
2017-01-11 Even Rouault <even.rouault at spatialys.com> 2017-01-11 Even Rouault <even.rouault at spatialys.com>
* libtiff/tif_jpeg.c: avoid integer division by zero in * libtiff/tif_jpeg.c: avoid integer division by zero in

11
libtiff/tif_dirwrite.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_dirwrite.c,v 1.83 2016-10-25 21:35:15 erouault Exp $ */ /* $Id: tif_dirwrite.c,v 1.84 2017-01-11 12:51:59 erouault Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -2094,10 +2094,15 @@ TIFFWriteDirectoryTagCheckedSlong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* d
static int static int
TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value) TIFFWriteDirectoryTagCheckedRational(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
{ {
static const char module[] = "TIFFWriteDirectoryTagCheckedRational";
uint32 m[2]; uint32 m[2];
assert(value>=0.0);
assert(sizeof(uint32)==4); assert(sizeof(uint32)==4);
if (value<=0.0) if( value < 0 )
{
TIFFErrorExt(tif->tif_clientdata,module,"Negative value is illegal");
return 0;
}
else if (value==0.0)
{ {
m[0]=0; m[0]=0;
m[1]=1; m[1]=1;

3
tools/tiffcrop.c
View File

@ -1,4 +1,4 @@
/* $Id: tiffcrop.c,v 1.49 2016-12-03 13:00:04 erouault Exp $ */ /* $Id: tiffcrop.c,v 1.50 2017-01-11 12:51:59 erouault Exp $ */
/* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of
* the image data through additional options listed below * the image data through additional options listed below
@ -7996,7 +7996,6 @@ writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image,
if (!TIFFWriteDirectory(out)) if (!TIFFWriteDirectory(out))
{ {
TIFFError("","Failed to write IFD for page number %d", pagenum); TIFFError("","Failed to write IFD for page number %d", pagenum);
TIFFClose(out);
return (-1); return (-1);
} }