diff options
| author | fwarmerdam <fwarmerdam> | 2010-06-14 00:19:22 +0000 |
|---|---|---|
| committer | fwarmerdam <fwarmerdam> | 2010-06-14 00:19:22 +0000 |
| commit | 3c20d38c92a6a9966535a9defe46fae4a5ccdb56 (patch) | |
| tree | a35680c7f9aa026bf2d5a147cd5352b9dc673bcb | |
| parent | 069f5e424826920d4d831ad8bcfc2df706c03d1e (diff) | |
| download | libtiff-3c20d38c92a6a9966535a9defe46fae4a5ccdb56.tar.gz | |
fixed inadequate validation of SubjectDistance (#2212)
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | libtiff/tif_dirread.c | 9 |
2 files changed, 11 insertions, 1 deletions
@@ -1,5 +1,8 @@ 2010-06-13 Frank Warmerdam <warmerdam@pobox.com> + * libtiff/tif_dirread.c: Fixed inadequate validation of the + SubjectDistance field (#2212). + * tiff2pdf.c: Fix assorted bugs in tiff2pdf: missing "return" in t2p_read_tiff_size() causes t2p->tiff_datasize to be set entirely wrong for COMPRESSION_JPEG case, resulting in memory stomp if actual diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index 79261c96..0c973ee9 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirread.c,v 1.92.2.7 2010-06-08 18:50:42 bfriesen Exp $ */ +/* $Id: tif_dirread.c,v 1.92.2.8 2010-06-14 00:19:22 fwarmerdam Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -1919,6 +1919,13 @@ TIFFFetchSubjectDistance(TIFF* tif, TIFFDirEntry* dir) float v; int ok = 0; + if( dir->tdir_count != 1 || dir->tdir_type != TIFF_RATIONAL ) + { + TIFFWarningExt(tif->tif_clientdata, tif->tif_name, + "incorrect count or type for SubjectDistance, tag ignored" ); + return (0); + } + if (TIFFFetchData(tif, dir, (char *)l) && cvtRational(tif, dir, l[0], l[1], &v)) { /* |