cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tif_webp.c: validate tile/strip dimension to avoid unsigned integer overflow in RGBA.size computation

Browse Source
This commit is contained in:
Even Rouault 2020-10-20 13:47:16 +02:00
parent 8aec9c8d29
commit b0469e8157
No known key found for this signature in database
GPG Key ID: 33EBBFC47B3DD87D
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libtiff/tif_webp.c
View File

@ -267,6 +267,12 @@ TWebPPreDecode(TIFF* tif, uint16 s)
segment_height = td->td_rowsperstrip; segment_height = td->td_rowsperstrip;
} }
if( segment_width > 16383 || segment_height > 16383 ) {
TIFFErrorExt(tif->tif_clientdata, module,
"WEBP maximum image dimensions are 16383 x 16383.");
return 0;
}
if( (sp->state & LSTATE_INIT_DECODE) == 0 ) if( (sp->state & LSTATE_INIT_DECODE) == 0 )
tif->tif_setupdecode(tif); tif->tif_setupdecode(tif);