cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Additional check for data integrity. Should finally close

Browse Source 
http://bugzilla.remotesensing.org/show_bug.cgi?id=100
This commit is contained in:
Andrey Kiselev 2002-04-16 13:49:14 +00:00
parent a9a67d4b70
commit d02bbd0006
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libtiff/tif_lzw.c
View File

@ -1,4 +1,4 @@
/* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_lzw.c,v 1.11 2002-04-04 14:35:35 dron Exp $ */ /* $Header: /cvs/maptools/cvsroot/libtiff/libtiff/tif_lzw.c,v 1.12 2002-04-16 13:49:14 dron Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -397,7 +397,7 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
* Add the new entry to the code table. * Add the new entry to the code table.
*/ */
if (&sp->dec_codetab[0] > free_entp || free_entp >= &sp->dec_codetab[CSIZE]) { if (&sp->dec_codetab[0] > free_entp || free_entp >= &sp->dec_codetab[CSIZE]) {
TIFFError(tif->tif_name, "LZWDecode: Unexpected end of code table"); TIFFError(tif->tif_name, "LZWDecode: Corrupted LZW table");
return (0); return (0);
} }
@ -427,6 +427,11 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
*/ */
sp->dec_codep = codep; sp->dec_codep = codep;
do { do {
if (codep < sp->dec_codetab) {
TIFFError(tif->tif_name,
"LZWDecode: Corrupted LZW data");
return (0);
}
codep = codep->next; codep = codep->next;
} while (codep && codep->length > occ); } while (codep && codep->length > occ);
if (codep) { if (codep) {