diff options
| -rw-r--r-- | libtiff/tif_lzw.c | 5 | ||||
| -rw-r--r-- | libtiff/tif_ojpeg.c | 3 | ||||
| -rw-r--r-- | tools/tiffcrop.c | 13 |
3 files changed, 17 insertions, 4 deletions
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c index ba75a07e..d631fa10 100644 --- a/libtiff/tif_lzw.c +++ b/libtiff/tif_lzw.c @@ -423,6 +423,10 @@ static int LZWDecode(TIFF *tif, uint8_t *op0, tmsize_t occ0, uint16_t s) if (sp->read_error) { + TIFFErrorExtR(tif, module, + "LZWDecode: Scanline %" PRIu32 " cannot be read due to " + "previous error", + tif->tif_row); return 0; } @@ -742,6 +746,7 @@ after_loop: return (1); no_eoi: + sp->read_error = 1; TIFFErrorExtR(tif, module, "LZWDecode: Strip %" PRIu32 " not terminated with EOI code", tif->tif_curstrip); diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c index 0c915de2..ea572091 100644 --- a/libtiff/tif_ojpeg.c +++ b/libtiff/tif_ojpeg.c @@ -1360,6 +1360,9 @@ static int OJPEGWriteHeaderInfo(TIFF *tif) { assert(sp->subsampling_convert_ycbcrbuf == 0); assert(sp->subsampling_convert_ycbcrimage == 0); + /* Check for division by zero. */ + if (sp->subsampling_hor == 0 || sp->subsampling_ver == 0) + return (0); sp->subsampling_convert_ylinelen = ((sp->strile_width + sp->subsampling_hor * 8 - 1) / (sp->subsampling_hor * 8) * sp->subsampling_hor * 8); diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index 24d0ca84..05a7c5f1 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -2822,9 +2822,14 @@ int main(int argc, char *argv[]) { /* Whole image or sections not based on output page size */ if (crop.selections > 0) { - writeSelections(in, &out, &crop, &image, &dump, seg_buffs, - mp, argv[argc - 1], &next_page, - total_pages); + if (writeSelections(in, &out, &crop, &image, &dump, + seg_buffs, mp, argv[argc - 1], + &next_page, total_pages)) + { + TIFFError("main", + "Unable to write new image selections"); + exit(EXIT_FAILURE); + } } else /* One file all images and sections */ { @@ -8785,7 +8790,7 @@ static int createCroppedImage(struct image_data *image, struct crop_mask *crop, /* Memory is freed before crop_buff_ptr is overwritten */ if (*crop_buff_ptr != NULL) { - _TIFFfree(*crop_buff_ptr); + _TIFFfree(*crop_buff_ptr); } /* process full image, no crop buffer needed */ |