diff options
| author | erouault <erouault> | 2017-01-11 16:33:34 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-01-11 16:33:34 +0000 |
| commit | ad7a973cce73e457f6b8bad8ee81ce076450e738 (patch) | |
| tree | 482a96a57deff5829e73b8e8f88e603b96e20e1b | |
| parent | 87c6812d42ba770d6c604da8ad1f2adefae0616e (diff) | |
| download | libtiff-ad7a973cce73e457f6b8bad8ee81ce076450e738.tar.gz | |
* libtiff/tif_read.c: avoid potential undefined behaviour on signed integer
addition in TIFFReadRawStrip1() in isMapped() case.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | libtiff/tif_read.c | 29 |
2 files changed, 25 insertions, 10 deletions
@@ -1,5 +1,11 @@ 2017-01-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_read.c: avoid potential undefined behaviour on signed integer + addition in TIFFReadRawStrip1() in isMapped() case. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2650 + +2017-01-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_jpeg.c: validate BitsPerSample in JPEGSetupEncode() to avoid undefined behaviour caused by invalid shift exponent. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2648 diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c index 29a311db..8c5af6a8 100644 --- a/libtiff/tif_read.c +++ b/libtiff/tif_read.c @@ -1,4 +1,4 @@ -/* $Id: tif_read.c,v 1.50 2016-12-02 21:56:56 erouault Exp $ */ +/* $Id: tif_read.c,v 1.51 2017-01-11 16:33:34 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -420,16 +420,25 @@ TIFFReadRawStrip1(TIFF* tif, uint32 strip, void* buf, tmsize_t size, return ((tmsize_t)(-1)); } } else { - tmsize_t ma,mb; + tmsize_t ma; tmsize_t n; - ma=(tmsize_t)td->td_stripoffset[strip]; - mb=ma+size; - if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)||(ma>tif->tif_size)) - n=0; - else if ((mb<ma)||(mb<size)||(mb>tif->tif_size)) - n=tif->tif_size-ma; - else - n=size; + if ((td->td_stripoffset[strip] > (uint64)TIFF_TMSIZE_T_MAX)|| + ((ma=(tmsize_t)td->td_stripoffset[strip])>tif->tif_size)) + { + n=0; + } + else if( ma > TIFF_TMSIZE_T_MAX - size ) + { + n=0; + } + else + { + tmsize_t mb=ma+size; + if (mb>tif->tif_size) + n=tif->tif_size-ma; + else + n=size; + } if (n!=size) { #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__)) TIFFErrorExt(tif->tif_clientdata, module, |