cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Error out on directory counting overflow.

Browse Source
This commit is contained in:
Frank Warmerdam 2013-10-21 18:23:48 +00:00
parent e289d76bce
commit e2f7c06cc5
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,3 +1,13 @@
2013-10-21 Frank Warmerdam <warmerdam@pobox.com>
* libtiff/tif_dir.c: generate error in case of directory count
overflow.
2013-10-01 Frank Warmerdam <warmerdam@pobox.com>
* libtiff/tiff.h, libtiff/tif_dirinfo.c: add definitions for
TIFF/EP CFARepeatPatternDim and CFAPattern tags (bug #2457)
2013-09-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> 2013-09-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
* libtiff/tif_dir.c (TIFFAdvanceDirectory): If nextdir is found to * libtiff/tif_dir.c (TIFFAdvanceDirectory): If nextdir is found to

12
libtiff/tif_dir.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_dir.c,v 1.114 2013-09-13 02:34:50 bfriesen Exp $ */ /* $Id: tif_dir.c,v 1.115 2013-10-21 18:23:48 fwarmerdam Exp $ */
/* /*
* Copyright (c) 1988-1997 Sam Leffler * Copyright (c) 1988-1997 Sam Leffler
@ -1471,6 +1471,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64* nextdir, uint64* off)
uint16 uint16
TIFFNumberOfDirectories(TIFF* tif) TIFFNumberOfDirectories(TIFF* tif)
{ {
static const char module[] = "TIFFNumberOfDirectories";
uint64 nextdir; uint64 nextdir;
uint16 n; uint16 n;
if (!(tif->tif_flags&TIFF_BIGTIFF)) if (!(tif->tif_flags&TIFF_BIGTIFF))
@ -1479,7 +1480,14 @@ TIFFNumberOfDirectories(TIFF* tif)
nextdir = tif->tif_header.big.tiff_diroff; nextdir = tif->tif_header.big.tiff_diroff;
n = 0; n = 0;
while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL)) while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
n++; {
if(n++ == 0)
{
TIFFErrorExt(tif->tif_clientdata, module,
"Directory count exceeded 65535 limit, giving up on counting.");
return (65535);
}
}
return (n); return (n);
} }