cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'issue-211' into 'master'

Browse Source 
check for tile width overflow

Closes #211

See merge request libtiff/libtiff!160
This commit is contained in:
Even Rouault 2020-11-12 15:52:43 +00:00
commit d167fbb6af
2 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libtiff/tif_dir.c
View File

@ -394,7 +394,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
if (tif->tif_mode != O_RDONLY) if (tif->tif_mode != O_RDONLY)
goto badvalue32; goto badvalue32;
TIFFWarningExt(tif->tif_clientdata, tif->tif_name, TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
"Nonstandard tile width %d, convert file", v32); "Nonstandard tile width %u, convert file", v32);
} }
td->td_tilewidth = v32; td->td_tilewidth = v32;
tif->tif_flags |= TIFF_ISTILED; tif->tif_flags |= TIFF_ISTILED;
@ -405,7 +405,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
if (tif->tif_mode != O_RDONLY) if (tif->tif_mode != O_RDONLY)
goto badvalue32; goto badvalue32;
TIFFWarningExt(tif->tif_clientdata, tif->tif_name, TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
"Nonstandard tile length %d, convert file", v32); "Nonstandard tile length %u, convert file", v32);
} }
td->td_tilelength = v32; td->td_tilelength = v32;
tif->tif_flags |= TIFF_ISTILED; tif->tif_flags |= TIFF_ISTILED;

9
libtiff/tif_getimage.c
View File

@ -29,6 +29,7 @@
*/ */
#include "tiffiop.h" #include "tiffiop.h"
#include <stdio.h> #include <stdio.h>
#include <limits.h>
static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32); static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32); static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
@ -645,10 +646,18 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
flip = setorientation(img); flip = setorientation(img);
if (flip & FLIP_VERTICALLY) { if (flip & FLIP_VERTICALLY) {
if ((tw + w) > INT_MAX) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = h - 1; y = h - 1;
toskew = -(int32)(tw + w); toskew = -(int32)(tw + w);
} }
else { else {
if (tw > (INT_MAX + w)) {
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
return (0);
}
y = 0; y = 0;
toskew = -(int32)(tw - w); toskew = -(int32)(tw - w);
} }