summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorfaxguy <faxguy>2015-06-13 05:03:50 +0000
committerfaxguy <faxguy>2015-06-13 05:03:50 +0000
commit78aa07502ef32c8151cc6548f29da4a63924247c (patch)
tree60780827cebb4594ff1c3644503798d7f91e2962
parent81bdbcaa72b357e1f095abac0b3725b66977e42f (diff)
downloadlibtiff-78aa07502ef32c8151cc6548f29da4a63924247c.tar.gz
Contribution from Andy Cave:
There is a longstanding bug in the LZW decompressor in LibTIFF. It fails to decode files that contain two consecutive CODE_CLEAR codes. These are allowed by the LZW spec and the same data sequence is correctly decoded by Acrobat if you wrap the data in a PDF file.
-rw-r--r--libtiff/tif_lzw.c38
1 files changed, 21 insertions, 17 deletions
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
index b81bc710..58345f0a 100644
--- a/libtiff/tif_lzw.c
+++ b/libtiff/tif_lzw.c
@@ -1,4 +1,4 @@
-/* $Id: tif_lzw.c,v 1.46 2014-11-20 16:47:21 erouault Exp $ */
+/* $Id: tif_lzw.c,v 1.47 2015-06-13 05:03:50 faxguy Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@@ -436,16 +436,18 @@ LZWDecode(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
if (code == CODE_EOI)
break;
if (code == CODE_CLEAR) {
- free_entp = sp->dec_codetab + CODE_FIRST;
- _TIFFmemset(free_entp, 0,
- (CSIZE - CODE_FIRST) * sizeof (code_t));
- nbits = BITS_MIN;
- nbitsmask = MAXCODE(BITS_MIN);
- maxcodep = sp->dec_codetab + nbitsmask-1;
- NextCode(tif, sp, bp, code, GetNextCode);
+ do {
+ free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0,
+ (CSIZE - CODE_FIRST) * sizeof (code_t));
+ nbits = BITS_MIN;
+ nbitsmask = MAXCODE(BITS_MIN);
+ maxcodep = sp->dec_codetab + nbitsmask-1;
+ NextCode(tif, sp, bp, code, GetNextCode);
+ } while (code == CODE_CLEAR); /* consecutive CODE_CLEAR codes */
if (code == CODE_EOI)
break;
- if (code >= CODE_CLEAR) {
+ if (code > CODE_CLEAR) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
"LZWDecode: Corrupted LZW table at scanline %d",
tif->tif_row);
@@ -655,16 +657,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
if (code == CODE_EOI)
break;
if (code == CODE_CLEAR) {
- free_entp = sp->dec_codetab + CODE_FIRST;
- _TIFFmemset(free_entp, 0,
- (CSIZE - CODE_FIRST) * sizeof (code_t));
- nbits = BITS_MIN;
- nbitsmask = MAXCODE(BITS_MIN);
- maxcodep = sp->dec_codetab + nbitsmask;
- NextCode(tif, sp, bp, code, GetNextCodeCompat);
+ do {
+ free_entp = sp->dec_codetab + CODE_FIRST;
+ _TIFFmemset(free_entp, 0,
+ (CSIZE - CODE_FIRST) * sizeof (code_t));
+ nbits = BITS_MIN;
+ nbitsmask = MAXCODE(BITS_MIN);
+ maxcodep = sp->dec_codetab + nbitsmask;
+ NextCode(tif, sp, bp, code, GetNextCodeCompat);
+ } while (code == CODE_CLEAR); /* consecutive CODE_CLEAR codes */
if (code == CODE_EOI)
break;
- if (code >= CODE_CLEAR) {
+ if (code > CODE_CLEAR) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
"LZWDecode: Corrupted LZW table at scanline %d",
tif->tif_row);