cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-204' into 'master'

Browse Source 
avoid buffer overflow while writing jpeg end of file marker

Closes #204

See merge request libtiff/libtiff!161
This commit is contained in:
Even Rouault 2020-11-14 12:51:06 +00:00
commit bf84e70665
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tools/tiff2pdf.c
View File

@ -2229,6 +2229,9 @@ int t2p_tile_is_corner_edge(T2P_TILES tiles, ttile_t tile){
return(t2p_tile_is_right_edge(tiles, tile) & t2p_tile_is_bottom_edge(tiles, tile) );
}
#if defined(JPEG_SUPPORT) || defined(OJPEG_SUPPORT)
static const unsigned char jpeg_eof_marker[] = { 0xff, 0xd9 };
#endif
/*
This function reads the raster image data from the input TIFF for an image and writes
@ -2448,11 +2451,10 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
}
bufferoffset += retTIFFReadRawStrip;
}
if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){
buffer[bufferoffset++]=0xff;
buffer[bufferoffset++]=0xd9;
}
t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
if( ! ( (buffer[bufferoffset-1]==0xd9) && (buffer[bufferoffset-2]==0xff) ) ){
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
}
_TIFFfree(buffer);
return(bufferoffset);
#if 0
@ -2533,9 +2535,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
return(0);
}
}
buffer[bufferoffset++]=0xff;
buffer[bufferoffset++]=0xd9;
t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
_TIFFfree(stripbuffer);
_TIFFfree(buffer);
return(bufferoffset);
@ -2999,9 +3000,8 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
return(0);
}
bufferoffset += retTIFFReadRawTile;
((unsigned char*)buffer)[bufferoffset++]=0xff;
((unsigned char*)buffer)[bufferoffset++]=0xd9;
t2pWriteFile(output, (tdata_t) buffer, bufferoffset);
t2pWriteFile(output, (tdata_t) jpeg_eof_marker, sizeof(jpeg_eof_marker));
_TIFFfree(buffer);
return(bufferoffset);
}