diff options
| author | faxguy <faxguy> | 2015-06-13 05:03:50 +0000 |
|---|---|---|
| committer | faxguy <faxguy> | 2015-06-13 05:03:50 +0000 |
| commit | 78aa07502ef32c8151cc6548f29da4a63924247c (patch) | |
| tree | 60780827cebb4594ff1c3644503798d7f91e2962 | |
| parent | 81bdbcaa72b357e1f095abac0b3725b66977e42f (diff) | |
| download | libtiff-78aa07502ef32c8151cc6548f29da4a63924247c.tar.gz | |
Contribution from Andy Cave:
There is a longstanding bug in the LZW decompressor in LibTIFF. It
fails to decode files that contain two consecutive CODE_CLEAR codes.
These are allowed by the LZW spec and the same data sequence is
correctly decoded by Acrobat if you wrap the data in a PDF file.
| -rw-r--r-- | libtiff/tif_lzw.c | 38 |
1 files changed, 21 insertions, 17 deletions
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c index b81bc710..58345f0a 100644 --- a/libtiff/tif_lzw.c +++ b/libtiff/tif_lzw.c @@ -1,4 +1,4 @@ -/* $Id: tif_lzw.c,v 1.46 2014-11-20 16:47:21 erouault Exp $ */ +/* $Id: tif_lzw.c,v 1.47 2015-06-13 05:03:50 faxguy Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -436,16 +436,18 @@ LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) if (code == CODE_EOI) break; if (code == CODE_CLEAR) { - free_entp = sp->dec_codetab + CODE_FIRST; - _TIFFmemset(free_entp, 0, - (CSIZE - CODE_FIRST) * sizeof (code_t)); - nbits = BITS_MIN; - nbitsmask = MAXCODE(BITS_MIN); - maxcodep = sp->dec_codetab + nbitsmask-1; - NextCode(tif, sp, bp, code, GetNextCode); + do { + free_entp = sp->dec_codetab + CODE_FIRST; + _TIFFmemset(free_entp, 0, + (CSIZE - CODE_FIRST) * sizeof (code_t)); + nbits = BITS_MIN; + nbitsmask = MAXCODE(BITS_MIN); + maxcodep = sp->dec_codetab + nbitsmask-1; + NextCode(tif, sp, bp, code, GetNextCode); + } while (code == CODE_CLEAR); /* consecutive CODE_CLEAR codes */ if (code == CODE_EOI) break; - if (code >= CODE_CLEAR) { + if (code > CODE_CLEAR) { TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "LZWDecode: Corrupted LZW table at scanline %d", tif->tif_row); @@ -655,16 +657,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s) if (code == CODE_EOI) break; if (code == CODE_CLEAR) { - free_entp = sp->dec_codetab + CODE_FIRST; - _TIFFmemset(free_entp, 0, - (CSIZE - CODE_FIRST) * sizeof (code_t)); - nbits = BITS_MIN; - nbitsmask = MAXCODE(BITS_MIN); - maxcodep = sp->dec_codetab + nbitsmask; - NextCode(tif, sp, bp, code, GetNextCodeCompat); + do { + free_entp = sp->dec_codetab + CODE_FIRST; + _TIFFmemset(free_entp, 0, + (CSIZE - CODE_FIRST) * sizeof (code_t)); + nbits = BITS_MIN; + nbitsmask = MAXCODE(BITS_MIN); + maxcodep = sp->dec_codetab + nbitsmask; + NextCode(tif, sp, bp, code, GetNextCodeCompat); + } while (code == CODE_CLEAR); /* consecutive CODE_CLEAR codes */ if (code == CODE_EOI) break; - if (code >= CODE_CLEAR) { + if (code > CODE_CLEAR) { TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "LZWDecode: Corrupted LZW table at scanline %d", tif->tif_row); |