cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* libtiff/tif_read.c (TIFFStartTile): Fix Coverity 715973

Browse Source 
"Division or modulo by zero".
This commit is contained in:
Bob Friesenhahn 2015-06-07 22:35:40 +00:00
parent 9904e70d72
commit f39fc2362e
4 changed files with 57 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
2015-06-07 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
* libtiff/tif_read.c (TIFFStartTile): Fix Coverity 715973
"Division or modulo by zero".
2015-05-31 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
* libtiff/tif_dir.c (TIFFNumberOfDirectories): Quiet Coverity

26
libtiff/tif_read.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_read.c,v 1.44 2014-12-23 10:15:35 erouault Exp $ */
/* $Id: tif_read.c,v 1.45 2015-06-07 22:35:40 bfriesen Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@ -990,10 +990,12 @@ TIFFStartStrip(TIFF* tif, uint32 strip)
static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
static const char module[] = "TIFFStartTile";
TIFFDirectory *td = &tif->tif_dir;
uint32 howmany32;
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
return 0;
if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
return 0;
if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
if (!(*tif->tif_setupdecode)(tif))
@ -1001,12 +1003,18 @@ TIFFStartTile(TIFF* tif, uint32 tile)
tif->tif_flags |= TIFF_CODERSETUP;
}
tif->tif_curtile = tile;
tif->tif_row =
(tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
td->td_tilelength;
tif->tif_col =
(tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
td->td_tilewidth;
howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
if (howmany32 == 0) {
TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
return 0;
}
tif->tif_row = (tile % howmany32) * td->td_tilelength;
howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
if (howmany32 == 0) {
TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
return 0;
}
tif->tif_col = (tile % howmany32) * td->td_tilewidth;
tif->tif_flags &= ~TIFF_BUF4WRITE;
if (tif->tif_flags&TIFF_NOREADRAW)
{

12
libtiff/tif_strip.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_strip.c,v 1.35 2012-06-06 05:33:55 fwarmerdam Exp $ */
/* $Id: tif_strip.c,v 1.36 2015-06-07 22:35:40 bfriesen Exp $ */
/*
* Copyright (c) 1991-1997 Sam Leffler
@ -317,7 +317,14 @@ TIFFScanlineSize64(TIFF* tif)
}
}
else
{
scanline_size=TIFFhowmany_64(_TIFFMultiply64(tif,td->td_imagewidth,td->td_bitspersample,module),8);
}
if (scanline_size == 0)
{
TIFFErrorExt(tif->tif_clientdata,module,"Computed scanline size is zero");
return 0;
}
return(scanline_size);
}
tmsize_t
@ -328,8 +335,7 @@ TIFFScanlineSize(TIFF* tif)
tmsize_t n;
m=TIFFScanlineSize64(tif);
n=(tmsize_t)m;
if ((uint64)n!=m)
{
if ((uint64)n!=m) {
TIFFErrorExt(tif->tif_clientdata,module,"Integer arithmetic overflow");
n=0;
}

29
libtiff/tif_tile.c
View File

@ -1,4 +1,4 @@
/* $Id: tif_tile.c,v 1.23 2012-06-06 05:33:55 fwarmerdam Exp $ */
/* $Id: tif_tile.c,v 1.24 2015-06-07 22:35:40 bfriesen Exp $ */
/*
* Copyright (c) 1991-1997 Sam Leffler
@ -143,17 +143,40 @@ TIFFNumberOfTiles(TIFF* tif)
uint64
TIFFTileRowSize64(TIFF* tif)
{
static const char module[] = "TIFFTileRowSize64";
TIFFDirectory *td = &tif->tif_dir;
uint64 rowsize;
uint64 tilerowsize;
if (td->td_tilelength == 0 || td->td_tilewidth == 0)
if (td->td_tilelength == 0)
{
TIFFErrorExt(tif->tif_clientdata,module,"Tile length is zero");
return 0;
}
if (td->td_tilewidth == 0)
{
TIFFErrorExt(tif->tif_clientdata,module,"Tile width is zero");
return (0);
}
rowsize = _TIFFMultiply64(tif, td->td_bitspersample, td->td_tilewidth,
"TIFFTileRowSize");
if (td->td_planarconfig == PLANARCONFIG_CONTIG)
{
if (td->td_samplesperpixel == 0)
{
TIFFErrorExt(tif->tif_clientdata,module,"Samples per pixel is zero");
return 0;
}
rowsize = _TIFFMultiply64(tif, rowsize, td->td_samplesperpixel,
"TIFFTileRowSize");
return (TIFFhowmany8_64(rowsize));
}
tilerowsize=TIFFhowmany8_64(rowsize);
if (tilerowsize == 0)
{
TIFFErrorExt(tif->tif_clientdata,module,"Computed tile row size is zero");
return 0;
}
return (tilerowsize);
}
tmsize_t
TIFFTileRowSize(TIFF* tif)