diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2020-10-20 13:47:16 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2020-10-20 13:47:16 +0200 |
| commit | b0469e8157cb8b694f261d28c98674c1d0ce85e6 (patch) | |
| tree | 80cb4c21a45554d5e00f212fc7a84c1fca48cef1 | |
| parent | 8aec9c8d29afc13b5166633be23c7eba1f901387 (diff) | |
| download | libtiff-git-b0469e8157cb8b694f261d28c98674c1d0ce85e6.tar.gz | |
tif_webp.c: validate tile/strip dimension to avoid unsigned integer overflow in RGBA.size computation
| -rw-r--r-- | libtiff/tif_webp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libtiff/tif_webp.c b/libtiff/tif_webp.c index 6ad20f78..a00478f6 100644 --- a/libtiff/tif_webp.c +++ b/libtiff/tif_webp.c @@ -267,6 +267,12 @@ TWebPPreDecode(TIFF* tif, uint16 s) segment_height = td->td_rowsperstrip; } + if( segment_width > 16383 || segment_height > 16383 ) { + TIFFErrorExt(tif->tif_clientdata, module, + "WEBP maximum image dimensions are 16383 x 16383."); + return 0; + } + if( (sp->state & LSTATE_INIT_DECODE) == 0 ) tif->tif_setupdecode(tif); |