diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2021-01-15 12:26:22 +0000 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2021-01-15 12:50:33 +0000 |
| commit | 4e956a2ee5137812007a7862a6eb8fddd9b709d2 (patch) | |
| tree | c44015b333d179dae1db50775db196c6f364331f /tiff/libtiff/tif_fax3.h | |
| parent | 35035761ffe178284c4ef9fc2ef75a4843e64a63 (diff) | |
| download | ghostpdl-4e956a2ee5137812007a7862a6eb8fddd9b709d2.tar.gz | |
Update libtiff to 4.2.0
And then re-apply: ef66198ade77d5d551b3045cd36bed81c0b04f54
Changes to libtiff for gpdl.
1) Ensure that libtiff doesn't mess with 'boolean' in GS builds
on Windows. Without this, the jpeg structures used by our JPEG
lib build are different in size when called from gs and libtiff,
resulting in runtime errors.
2) Update libtiff so that it can correctly call into the jpeg
library so that memory operations happen from our pools, not
malloc/free. Slightly horrid in that this is more complex with
OJPEG than JPEG files.
Diffstat (limited to 'tiff/libtiff/tif_fax3.h')
| -rw-r--r-- | tiff/libtiff/tif_fax3.h | 39 |
1 files changed, 34 insertions, 5 deletions
diff --git a/tiff/libtiff/tif_fax3.h b/tiff/libtiff/tif_fax3.h index abadcd97a..701716cc1 100644 --- a/tiff/libtiff/tif_fax3.h +++ b/tiff/libtiff/tif_fax3.h @@ -240,6 +240,11 @@ static const char* StateNames[] = { * current row and reset decoding state. */ #define SETVALUE(x) do { \ + if (pa >= thisrun + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ *pa++ = RunLength + (x); \ a0 += (x); \ RunLength = 0; \ @@ -377,6 +382,11 @@ done1d: \ */ #define CHECK_b1 do { \ if (pa != thisrun) while (b1 <= a0 && b1 < lastx) { \ + if( pb + 1 >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += pb[0] + pb[1]; \ pb += 2; \ } \ @@ -387,10 +397,20 @@ done1d: \ */ #define EXPAND2D(eoflab) do { \ while (a0 < lastx) { \ + if (pa >= thisrun + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ LOOKUP8(7, TIFFFaxMainTable, eof2d); \ switch (TabEnt->State) { \ case S_Pass: \ CHECK_b1; \ + if( pb + 1 >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ RunLength += b1 - a0; \ a0 = b1; \ @@ -469,20 +489,28 @@ done1d: \ case S_V0: \ CHECK_b1; \ SETVALUE(b1 - a0); \ + if( pb >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ break; \ case S_VR: \ CHECK_b1; \ SETVALUE(b1 - a0 + TabEnt->Param); \ + if( pb >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ break; \ case S_VL: \ CHECK_b1; \ - if (b1 <= (int) (a0 + TabEnt->Param)) { \ - if (b1 < (int) (a0 + TabEnt->Param) || pa != thisrun) { \ - unexpected("VL", a0); \ - goto eol2d; \ - } \ + if (b1 < (int) (a0 + TabEnt->Param)) { \ + unexpected("VL", a0); \ + goto eol2d; \ } \ SETVALUE(b1 - a0 - TabEnt->Param); \ b1 -= *--pb; \ @@ -529,6 +557,7 @@ eol2d: \ CLEANUP_RUNS(); \ } while (0) #endif /* _FAX3_ */ +/* vim: set ts=8 sts=4 sw=4 noet: */ /* * Local Variables: * mode: c |