From c51400048e12f4a72a105795fc65dbc082197def Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Wed, 15 Apr 2020 20:14:47 +0200 Subject: [PATCH] Fix wrong file size checks for memory-mapped BigTIFF files that could lead to image rejection --- libtiff/tif_dirread.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index 3c5adb2b..4950b82c 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -864,7 +864,7 @@ static enum TIFFReadDirEntryErr TIFFReadDirEntryArrayWithLimit( datasize=(*count)*typesize; assert((tmsize_t)datasize>0); - if( isMapped(tif) && datasize > (uint32)tif->tif_size ) + if( isMapped(tif) && datasize > (uint64)tif->tif_size ) return TIFFReadDirEntryErrIo; if( !isMapped(tif) && @@ -3400,7 +3400,7 @@ TIFFReadDirEntryData(TIFF* tif, uint64 offset, tmsize_t size, void* dest) return TIFFReadDirEntryErrIo; } mb=ma+size; - if (mb > (size_t)tif->tif_size) + if (mb > (uint64)tif->tif_size) return(TIFFReadDirEntryErrIo); _TIFFmemcpy(dest,tif->tif_base+ma,size); }