diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2017-07-24 12:47:30 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2017-07-24 12:47:30 +0000 |
| commit | 8ad1c70dc11d897f5b5c5902177a8ace906eb8fe (patch) | |
| tree | 575d59cfaf98a422c41cbc8865c4991e30c6274a | |
| parent | 06155116f6ee7f910ac5a8a60e0852c621d72306 (diff) | |
| download | libtiff-git-8ad1c70dc11d897f5b5c5902177a8ace906eb8fe.tar.gz | |
* libtiff/tif_luv.c: further reduce memory requirements for temporary
buffer when RowsPerStrip >= image_length in LogLuvInitState() and
LogL16InitState().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
Credit to OSS Fuzz
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | libtiff/tif_luv.c | 6 |
2 files changed, 11 insertions, 3 deletions
@@ -1,5 +1,13 @@ 2017-07-24 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_luv.c: further reduce memory requirements for temporary + buffer when RowsPerStrip >= image_length in LogLuvInitState() and + LogL16InitState(). + Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700 + Credit to OSS Fuzz + +2017-07-24 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_getimage.c: fix fromskew computation when to-be-skipped pixel number is not a multiple of the horizontal subsampling, and also in some other cases. Impact putcontig8bitYCbCr44tile, diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c index 0404ec16..4b25244b 100644 --- a/libtiff/tif_luv.c +++ b/libtiff/tif_luv.c @@ -1,4 +1,4 @@ -/* $Id: tif_luv.c,v 1.48 2017-07-18 19:45:12 erouault Exp $ */ +/* $Id: tif_luv.c,v 1.49 2017-07-24 12:47:30 erouault Exp $ */ /* * Copyright (c) 1997 Greg Ward Larson @@ -1314,7 +1314,7 @@ LogL16InitState(TIFF* tif) } if( isTiled(tif) ) sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength); - else if( td->td_rowsperstrip != (uint32)-1 ) + else if( td->td_rowsperstrip < td->td_imagelength ) sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip); else sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength); @@ -1416,7 +1416,7 @@ LogLuvInitState(TIFF* tif) } if( isTiled(tif) ) sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength); - else if( td->td_rowsperstrip != (uint32)-1 ) + else if( td->td_rowsperstrip < td->td_imagelength ) sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip); else sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength); |