cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fax4Decode(): log error message in case of buffer overrun

Browse Source
This commit is contained in:
Thomas Bernard 2020-02-29 11:24:49 +01:00
parent c4710ee226
commit df38126420
No known key found for this signature in database
GPG Key ID: 0FF11B67A5C0863C
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libtiff/tif_fax3.c
View File

@ -1453,8 +1453,13 @@ Fax4Decode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
EXPAND2D(EOFG4);
if (EOLcnt)
goto EOFG4;
if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overflow */
if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overrun */
{
TIFFErrorExt(tif->tif_clientdata, module,
"Buffer overrun detected : %d bytes available, %d bits needed",
(int)occ, lastx);
return -1;
}
(*sp->fill)(buf, thisrun, pa, lastx);
SETVALUE(0); /* imaginary change for reference */
SWAP(uint32*, sp->curruns, sp->refruns);
@ -1470,8 +1475,13 @@ Fax4Decode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
fputs( "Bad EOFB\n", stderr );
#endif
ClrBits( 13 );
if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overflow */
if (((lastx + 7) >> 3) > (int)occ) /* check for buffer overrun */
{
TIFFErrorExt(tif->tif_clientdata, module,
"Buffer overrun detected : %d bytes available, %d bits needed",
(int)occ, lastx);
return -1;
}
(*sp->fill)(buf, thisrun, pa, lastx);
UNCACHE_STATE(tif, sp);
return ( sp->line ? 1 : -1); /* don't error on badly-terminated strips */