cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gtTileContig(): check Tile width for overflow

Browse Source 
fixes #211
This commit is contained in:
Thomas Bernard 2020-11-10 01:54:30 +01:00
parent 712fe9f5b9
commit c8d613ef49
No known key found for this signature in database
GPG Key ID: DB511043A31ACAAF
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libtiff/tif_getimage.c
View File

@ -29,6 +29,7 @@
*/ */
#include "tiffiop.h" #include "tiffiop.h"
#include <stdio.h> #include <stdio.h>
#include <limits.h>
static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32); static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32); static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
@ -645,10 +646,18 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img); flip = setorientation(img);
if (flip & FLIP_VERTICALLY) { if (flip & FLIP_VERTICALLY) {
if ((tw + w) > INT_MAX) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = h - 1; y = h - 1;
toskew = -(int32)(tw + w); toskew = -(int32)(tw + w);
} }
else { else {
if (tw > (INT_MAX + w)) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = 0; y = 0;
toskew = -(int32)(tw - w); toskew = -(int32)(tw - w);
} }