diff options
| author | Frank Warmerdam <warmerdam@pobox.com> | 2012-04-06 16:46:31 +0000 |
|---|---|---|
| committer | Frank Warmerdam <warmerdam@pobox.com> | 2012-04-06 16:46:31 +0000 |
| commit | f502a159f92f6ad04febdb1c1012e7c5a4473fdf (patch) | |
| tree | 2ee2d9a05ed2bee3ade2da3652702836609a92f1 | |
| parent | 7017b048e14ff8cd082e60353a533d078a9d44fd (diff) | |
| download | libtiff-git-f502a159f92f6ad04febdb1c1012e7c5a4473fdf.tar.gz | |
Fix size overflow (zdi-can-1221,CVE-2012-1173) care of Tom Lane @ Red Hat.
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | libtiff/tif_getimage.c | 22 | ||||
| -rw-r--r-- | libtiff/tiffiop.h | 4 |
3 files changed, 24 insertions, 7 deletions
@@ -1,3 +1,8 @@ +2012-03-30 Frank Warmerdam <warmerdam@google.com> + + * tif_getimage.c: Fix size overflow (zdi-can-1221,CVE-2012-1173) + care of Tom Lane @ Red Hat. + 2012-02-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> * libtiff 4.0.1 released. diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 6a09b4d2..c897f5af 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -1,4 +1,4 @@ -/* $Id: tif_getimage.c,v 1.78 2011-02-23 21:46:09 fwarmerdam Exp $ */ +/* $Id: tif_getimage.c,v 1.79 2012-04-06 16:46:46 fwarmerdam Exp $ */ /* * Copyright (c) 1991-1997 Sam Leffler @@ -692,6 +692,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) unsigned char* p2; unsigned char* pa; tmsize_t tilesize; + tmsize_t bufsize; int32 fromskew, toskew; int alpha = img->alpha; uint32 nrow; @@ -699,12 +700,17 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) int colorchannels; tilesize = TIFFTileSize(tif); - buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize); + bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize); + if (bufsize == 0) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate"); + return (0); + } + buf = (unsigned char*) _TIFFmalloc(bufsize); if (buf == 0) { TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer"); return (0); } - _TIFFmemset(buf, 0, (alpha?4:3)*tilesize); + _TIFFmemset(buf, 0, bufsize); p0 = buf; p1 = p0 + tilesize; p2 = p1 + tilesize; @@ -917,17 +923,23 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) uint32 rowsperstrip, offset_row; uint32 imagewidth = img->width; tmsize_t stripsize; + tmsize_t bufsize; int32 fromskew, toskew; int alpha = img->alpha; int ret = 1, flip, colorchannels; stripsize = TIFFStripSize(tif); - p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize); + bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize); + if (bufsize == 0) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate"); + return (0); + } + p0 = buf = (unsigned char *)_TIFFmalloc(bufsize); if (buf == 0) { TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); return (0); } - _TIFFmemset(buf, 0, (alpha?4:3)*stripsize); + _TIFFmemset(buf, 0, bufsize); p1 = p0 + stripsize; p2 = p1 + stripsize; pa = (alpha?(p2+stripsize):NULL); diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h index 7bed4abd..5981a5b6 100644 --- a/libtiff/tiffiop.h +++ b/libtiff/tiffiop.h @@ -1,4 +1,4 @@ -/* $Id: tiffiop.h,v 1.82 2011-02-18 20:53:05 fwarmerdam Exp $ */ +/* $Id: tiffiop.h,v 1.83 2012-04-06 16:46:47 fwarmerdam Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -250,7 +250,7 @@ struct tiff { #define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y)) /* Safe multiply which returns zero if there is an integer overflow */ -#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0) +#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) #define TIFFmax(A,B) ((A)>(B)?(A):(B)) #define TIFFmin(A,B) ((A)<(B)?(A):(B)) |