From c4710ee22625cc3104ac12b3a19298675b664d88 Mon Sep 17 00:00:00 2001 From: Thomas Bernard Date: Sun, 16 Feb 2020 18:51:49 +0100 Subject: [PATCH] tif_fax3.c: check buffer overflow in Fax4Decode() fixes #174 --- libtiff/tif_fax3.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libtiff/tif_fax3.c b/libtiff/tif_fax3.c index d11c9684..5ad52254 100644 --- a/libtiff/tif_fax3.c +++ b/libtiff/tif_fax3.c @@ -1453,6 +1453,8 @@ Fax4Decode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) EXPAND2D(EOFG4); if (EOLcnt) goto EOFG4; + if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overflow */ + return -1; (*sp->fill)(buf, thisrun, pa, lastx); SETVALUE(0); /* imaginary change for reference */ SWAP(uint32*, sp->curruns, sp->refruns); @@ -1468,6 +1470,8 @@ Fax4Decode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) fputs( "Bad EOFB\n", stderr ); #endif ClrBits( 13 ); + if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overflow */ + return -1; (*sp->fill)(buf, thisrun, pa, lastx); UNCACHE_STATE(tif, sp); return ( sp->line ? 1 : -1); /* don't error on badly-terminated strips */