diff options
| author | bfriesen <bfriesen> | 2014-12-10 02:53:30 +0000 |
|---|---|---|
| committer | bfriesen <bfriesen> | 2014-12-10 02:53:30 +0000 |
| commit | 503a5c98f8376e11b72da79f32e9c355b0e4d7bb (patch) | |
| tree | bf409b39cb0a1de841e08ba1e27ab966889be8f3 | |
| parent | 5c47888cc9692256d2a39f5ce0aa306a2d67a8ce (diff) | |
| download | libtiff-503a5c98f8376e11b72da79f32e9c355b0e4d7bb.tar.gz | |
* tools/tiff2pdf.c: Assure that memory size calculations for
_TIFFmalloc() do not overflow the range of tmsize_t.
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | tools/tiff2pdf.c | 20 |
2 files changed, 15 insertions, 10 deletions
@@ -1,3 +1,8 @@ +2014-12-09 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + + * tools/tiff2pdf.c: Assure that memory size calculations for + _TIFFmalloc() do not overflow the range of tmsize_t. + 2014-12-07 Even Rouault <even.rouault@spatialys.com> * tools/thumbnail.c, tools/tiffcrop.c: "fix" heap read over-run found with diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 610a80c8..34354747 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -1,4 +1,4 @@ -/* $Id: tiff2pdf.c,v 1.76 2014-12-07 19:32:25 bfriesen Exp $ +/* $Id: tiff2pdf.c,v 1.77 2014-12-10 02:53:30 bfriesen Exp $ * * tiff2pdf - converts a TIFF image to a PDF document * @@ -1035,7 +1035,7 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ uint16 xuint16=0; directorycount=TIFFNumberOfDirectories(input); - t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE)); + t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE))); if(t2p->tiff_pages==NULL){ TIFFError( TIFF2PDF_MODULE, @@ -1046,7 +1046,7 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ return; } _TIFFmemset( t2p->tiff_pages, 0x00, directorycount * sizeof(T2P_PAGE)); - t2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(directorycount * sizeof(T2P_TILES)); + t2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_TILES))); if(t2p->tiff_tiles==NULL){ TIFFError( TIFF2PDF_MODULE, @@ -1179,9 +1179,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ TIFFTAG_TILELENGTH, &( t2p->tiff_tiles[i].tiles_tilelength) ); t2p->tiff_tiles[i].tiles_tiles = - (T2P_TILE*) _TIFFmalloc( - t2p->tiff_tiles[i].tiles_tilecount - * sizeof(T2P_TILE) ); + (T2P_TILE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->tiff_tiles[i].tiles_tilecount, + sizeof(T2P_TILE)) ); if( t2p->tiff_tiles[i].tiles_tiles == NULL){ TIFFError( TIFF2PDF_MODULE, @@ -1451,7 +1450,7 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ t2p->pdf_palette=NULL; } t2p->pdf_palette = (unsigned char*) - _TIFFmalloc(t2p->pdf_palettesize*3); + _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->pdf_palettesize,3)); if(t2p->pdf_palette==NULL){ TIFFError( TIFF2PDF_MODULE, @@ -1520,7 +1519,7 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ t2p->pdf_palette=NULL; } t2p->pdf_palette = (unsigned char*) - _TIFFmalloc(t2p->pdf_palettesize*4); + _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->pdf_palettesize,4)); if(t2p->pdf_palette==NULL){ TIFFError( TIFF2PDF_MODULE, @@ -2109,7 +2108,8 @@ tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){ _TIFFmalloc(t2p->tiff_datasize); if (buffer == NULL) { TIFFError(TIFF2PDF_MODULE, - "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s", + "Can't allocate %lu bytes of memory for " + "t2p_readwrite_pdf_image, %s", (unsigned long) t2p->tiff_datasize, TIFFFileName(input)); t2p->t2p_error = T2P_ERR_ERROR; @@ -5222,7 +5222,7 @@ tsize_t t2p_write_pdf(T2P* t2p, TIFF* input, TIFF* output){ t2p_read_tiff_init(t2p, input); if(t2p->t2p_error!=T2P_ERR_OK){return(0);} - t2p->pdf_xrefoffsets= (uint32*) _TIFFmalloc(t2p->pdf_xrefcount * sizeof(uint32) ); + t2p->pdf_xrefoffsets= (uint32*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->pdf_xrefcount,sizeof(uint32)) ); if(t2p->pdf_xrefoffsets==NULL){ TIFFError( TIFF2PDF_MODULE, |