diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2020-11-14 12:44:43 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2020-11-14 12:44:43 +0000 |
| commit | 026c2bce9f4116d0a5677599922a4fda8385534e (patch) | |
| tree | 8a0347ec8737cf1998db04546b4b435d0bb8eb8c | |
| parent | d40507b815765637782b3bd4757bf227738c5e08 (diff) | |
| parent | 2105b200df3ddda1e51f7ca9b2bac561da44188d (diff) | |
| download | libtiff-git-026c2bce9f4116d0a5677599922a4fda8385534e.tar.gz | |
Merge branch 'skal65535-master-patch-91082' into 'master'
More overflow fixes for large widths
See merge request libtiff/libtiff!164
| -rw-r--r-- | libtiff/tif_getimage.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 0ad79b7f..3460af74 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -774,10 +774,18 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ((tw + w) > INT_MAX) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = h - 1; toskew = -(int32)(tw + w); } else { + if (tw > (INT_MAX + w)) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = 0; toskew = -(int32)(tw - w); } @@ -945,9 +953,9 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { - if ( w > 0x7FFFFFFFu ) { - TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); - return (0); + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); } y = h - 1; toskew = -(int32)(w + w); @@ -1045,6 +1053,10 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); + } y = h - 1; toskew = -(int32)(w + w); } |