cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'bug2855' into 'master'

Browse Source 
tiff2ps: fix heap buffer read overflow in PSDataColorContig()

Closes #161

See merge request libtiff/libtiff!102
This commit is contained in:
Even Rouault 2020-02-09 13:11:39 +00:00
commit b4820b2179
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tools/tiff2ps.c
View File

@ -2467,8 +2467,10 @@ PSDataColorContig(FILE* fd, TIFF* tif, uint32 w, uint32 h, int nc)
}
if (alpha) {
int adjust;
cc = 0;
for (; (cc + nc) <= tf_bytesperrow; cc += samplesperpixel) {
/*
* the code inside this loop reads nc bytes + 1 extra byte (for adjust)
*/
for (cc = 0; (cc + nc) < tf_bytesperrow; cc += samplesperpixel) {
DOBREAK(breaklen, nc, fd);
/*
* For images with alpha, matte against
@ -2486,8 +2488,10 @@ PSDataColorContig(FILE* fd, TIFF* tif, uint32 w, uint32 h, int nc)
cp += es;
}
} else {
cc = 0;
for (; (cc + nc) <= tf_bytesperrow; cc += samplesperpixel) {
/*
* the code inside this loop reads nc bytes per iteration
*/
for (cc = 0; (cc + nc) <= tf_bytesperrow; cc += samplesperpixel) {
DOBREAK(breaklen, nc, fd);
switch (nc) {
case 4: c = *cp++; PUTHEX(c,fd);