cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avoid buffer overflow while writing jpeg end of file marker

Browse Source 
fixes #204
This commit is contained in:
Thomas Bernard 2020-11-10 02:35:13 +01:00
parent 2e822691d7
commit a61c255236
No known key found for this signature in database
GPG Key ID: DB511043A31ACAAF
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tools/tiff2pdf.c
View File

@ -2229,6 +2229,9 @@ int t2p_tile_is_corner_edge(T2P_TILES tiles, ttile_t tile){
return(t2p_tile_is_right_edge(tiles, tile) & t2p_tile_is_bottom_edge(tiles, tile) ); return(t2p_tile_is_right_edge(tiles, tile) & t2p_tile_is_bottom_edge(tiles, tile) );
} }
#if defined(JPEG_SUPPORT) || defined(OJPEG_SUPPORT)
static const unsigned char jpeg_eof_marker[] = { 0xff, 0xd9 };
#endif
/* /*
This function reads the raster image data from the input TIFF for an image and writes This function reads the raster image data from the input TIFF for an image and writes
@ -2448,11 +2451,10 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
} }
bufferoffset += retTIFFReadRawStrip; bufferoffset += retTIFFReadRawStrip;
} }
if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){
buffer[bufferoffset++]=0xff;
buffer[bufferoffset++]=0xd9;
}
t2pWriteFile(output, (tdata_t) buffer, bufferoffset); t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
}
_TIFFfree(buffer); _TIFFfree(buffer);
return(bufferoffset); return(bufferoffset);
#if 0 #if 0
@ -2533,9 +2535,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
return(0); return(0);
} }
} }
buffer[bufferoffset++]=0xff;
buffer[bufferoffset++]=0xd9;
t2pWriteFile(output, (tdata_t) buffer, bufferoffset); t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
_TIFFfree(stripbuffer); _TIFFfree(stripbuffer);
_TIFFfree(buffer); _TIFFfree(buffer);
return(bufferoffset); return(bufferoffset);
@ -2999,9 +3000,8 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
return(0); return(0);
} }
bufferoffset += retTIFFReadRawTile; bufferoffset += retTIFFReadRawTile;
((unsigned char*)buffer)[bufferoffset++]=0xff;
((unsigned char*)buffer)[bufferoffset++]=0xd9;
t2pWriteFile(output, (tdata_t) buffer, bufferoffset); t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
_TIFFfree(buffer); _TIFFfree(buffer);
return(bufferoffset); return(bufferoffset);
} }