cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tif_fax3.h: return error when a buffer overflow occurs. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25552 and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25849

Browse Source
This commit is contained in:
Even Rouault 2020-09-22 18:27:44 +02:00
parent 57d487aa1c
commit c8f0a16f4a
No known key found for this signature in database
GPG Key ID: 33EBBFC47B3DD87D
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libtiff/tif_fax3.h
View File

@ -240,6 +240,11 @@ static const char* StateNames[] = {
* current row and reset decoding state. * current row and reset decoding state.
*/ */
#define SETVALUE(x) do { \ #define SETVALUE(x) do { \
if (pa >= thisrun + sp->nruns) { \
TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \
sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \
return (-1); \
} \
*pa++ = RunLength + (x); \ *pa++ = RunLength + (x); \
a0 += (x); \ a0 += (x); \
RunLength = 0; \ RunLength = 0; \