diff options
| author | erouault <erouault> | 2017-04-27 19:50:01 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-04-27 19:50:01 +0000 |
| commit | ce502b8863e5ae916e591a6212279966d9563bce (patch) | |
| tree | c6004625cf0f708f66b54a13a74942ec75a4609c | |
| parent | cf9d7dabaaf759ab71f4449fb8bb25d62172e944 (diff) | |
| download | libtiff-ce502b8863e5ae916e591a6212279966d9563bce.tar.gz | |
* litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file.
Patch by Alan Coopersmith + complement by myself.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673
* tools/fax2tiff.c: emit appropriate message if the input file is
empty. Patch by Alan Coopersmith.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672
| -rw-r--r-- | ChangeLog | 9 | ||||
| -rw-r--r-- | libtiff/tif_fax3.c | 5 | ||||
| -rw-r--r-- | tools/fax2tiff.c | 6 |
3 files changed, 17 insertions, 3 deletions
@@ -1,5 +1,14 @@ 2017-04-27 Even Rouault <even.rouault at spatialys.com> + * litiff/tif_fax3.c: avoid crash in Fax3Close() on empty file. + Patch by Alan Coopersmith + complement by myself. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2673 + * tools/fax2tiff.c: emit appropriate message if the input file is + empty. Patch by Alan Coopersmith. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2672 + +2017-04-27 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_ojpeg.c: fix potential memory leak in OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and OJPEGReadHeaderInfoSecTablesAcTable diff --git a/libtiff/tif_fax3.c b/libtiff/tif_fax3.c index 519b285b..087ceddd 100644 --- a/libtiff/tif_fax3.c +++ b/libtiff/tif_fax3.c @@ -1,4 +1,4 @@ -/* $Id: tif_fax3.c,v 1.79 2017-02-25 17:05:12 erouault Exp $ */ +/* $Id: tif_fax3.c,v 1.80 2017-04-27 19:50:01 erouault Exp $ */ /* * Copyright (c) 1990-1997 Sam Leffler @@ -1129,7 +1129,7 @@ Fax3PostEncode(TIFF* tif) static void Fax3Close(TIFF* tif) { - if ((Fax3State(tif)->mode & FAXMODE_NORTC) == 0) { + if ((Fax3State(tif)->mode & FAXMODE_NORTC) == 0 && tif->tif_rawcp) { Fax3CodecState* sp = EncoderState(tif); unsigned int code = EOL; unsigned int length = 12; @@ -1351,6 +1351,7 @@ InitCCITTFax3(TIFF* tif) "No space for state block"); return (0); } + _TIFFmemset(tif->tif_data, 0, sizeof (Fax3CodecState)); sp = Fax3State(tif); sp->rw_mode = tif->tif_mode; diff --git a/tools/fax2tiff.c b/tools/fax2tiff.c index 01f85540..d43c2dca 100644 --- a/tools/fax2tiff.c +++ b/tools/fax2tiff.c @@ -1,4 +1,4 @@ -/* $Id: fax2tiff.c,v 1.26 2016-11-20 18:04:52 bfriesen Exp $ */ +/* $Id: fax2tiff.c,v 1.27 2017-04-27 19:50:01 erouault Exp $ */ /* * Copyright (c) 1990-1997 Sam Leffler @@ -371,6 +371,10 @@ copyFaxFile(TIFF* tifin, TIFF* tifout) int ok; tifin->tif_rawdatasize = (tmsize_t)TIFFGetFileSize(tifin); + if (tifin->tif_rawdatasize == 0) { + TIFFError(tifin->tif_name, "Empty input file"); + return (0); + } tifin->tif_rawdata = _TIFFmalloc(tifin->tif_rawdatasize); if (tifin->tif_rawdata == NULL) { TIFFError(tifin->tif_name, "Not enough memory"); |