diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2022-01-10 18:56:51 +0100 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2022-01-10 18:56:51 +0100 |
| commit | 0620a8f44a09bc672e326b2acbc7c1329604c8da (patch) | |
| tree | 9cf29334974e9b03d3709c2a541e4b7443e39f6f | |
| parent | cd57b554aa906bba367d262b7b4521e935164df5 (diff) | |
| download | libtiff-git-0620a8f44a09bc672e326b2acbc7c1329604c8da.tar.gz | |
Fix sanity check in TIFFFillStrip()/TIFFFillStrile()
A sanity check comparing the compressed vs uncompressed file that was
originally written 'correctly' but relied on undefined behaviour was
changed in 1b5e3b6a23827c33acf19ad50ce5ce78f12b3773 in an incorrect way.
Fix that. Credits to @burn for spotting this in
https://gitlab.com/libtiff/libtiff/-/issues/343#note_806089714
| -rw-r--r-- | libtiff/tif_read.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c index a4c60b4f..06377d80 100644 --- a/libtiff/tif_read.c +++ b/libtiff/tif_read.c @@ -751,7 +751,7 @@ TIFFFillStrip(TIFF* tif, uint32_t strip) (bytecount - 4096) / 10 > (uint64_t)stripsize ) { uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; - if( newbytecount == 0 || newbytecount > (uint64_t)TIFF_INT64_MAX ) + if( newbytecount <= (uint64_t)TIFF_INT64_MAX ) { TIFFErrorExt(tif->tif_clientdata, module, "Too large strip byte count %"PRIu64", strip %"PRIu32". Limiting to %"PRIu64, @@ -1145,7 +1145,7 @@ TIFFFillTile(TIFF* tif, uint32_t tile) (bytecount - 4096) / 10 > (uint64_t)stripsize ) { uint64_t newbytecount = (uint64_t)stripsize * 10 + 4096; - if( newbytecount == 0 || newbytecount > (uint64_t)TIFF_INT64_MAX ) + if( newbytecount <= (uint64_t)TIFF_INT64_MAX ) { TIFFErrorExt(tif->tif_clientdata, module, "Too large tile byte count %"PRIu64", tile %"PRIu32". Limiting to %"PRIu64, |