diff options
| author | dron <dron> | 2011-02-25 15:28:29 +0000 |
|---|---|---|
| committer | dron <dron> | 2011-02-25 15:28:29 +0000 |
| commit | 8b1c79e715e24325a713b8b367d2ab262b89b575 (patch) | |
| tree | 3e78577ca2655e61c601d14fefe23130cc577830 | |
| parent | 8f14d5f019f4d0087053052815387202f60b9d32 (diff) | |
| download | libtiff-8b1c79e715e24325a713b8b367d2ab262b89b575.tar.gz | |
Avoid undefined behaviour when casting from float to unsigned integer in
TIFFWriteRationalArray() as reported by Kareem Shehata.
| -rw-r--r-- | ChangeLog | 12 | ||||
| -rw-r--r-- | libtiff/tif_dirwrite.c | 4 |
2 files changed, 11 insertions, 5 deletions
@@ -1,3 +1,9 @@ +2011-02-25 Andrey Kiselev <dron@ak4719.spb.edu> + + * libtiff/tif_dirwrite.c: Avoid undefined behaviour when casting from + float to unsigned integer in TIFFWriteRationalArray() as reported by + Kareem Shehata. + 2011-01-03 Lee Howard <faxguy@howardsilvan.com> * libtiff/tif_jpeg.c: Fix regressions with 2 and 3 band images @@ -87,8 +93,8 @@ 2010-12-11 Lee Howard <faxguy@howardsilvan.com> - * libtiff/tif_ojpeg.c: fix buffer overflow on problem data - http://bugzilla.maptools.org/show_bug.cgi?id=1999 + * libtiff/tif_ojpeg.c: fix buffer overflow on problem data + http://bugzilla.maptools.org/show_bug.cgi?id=1999 2010-12-11 Lee Howard <faxguy@howardsilvan.com> @@ -132,7 +138,7 @@ 2010-07-07 Andrey Kiselev <dron@ak4719.spb.edu> - * lintiff/tif_dirread.c: Really reset the tag count in CheckDirCount() + * libtiff/tif_dirread.c: Really reset the tag count in CheckDirCount() to expected value as the warning message suggests. As per bug http://bugzilla.maptools.org/show_bug.cgi?id=1963 diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c index a9f2ec79..6f298399 100644 --- a/libtiff/tif_dirwrite.c +++ b/libtiff/tif_dirwrite.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirwrite.c,v 1.37.2.8 2010-07-06 14:05:30 dron Exp $ */ +/* $Id: tif_dirwrite.c,v 1.37.2.9 2011-02-25 15:28:30 dron Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -1041,7 +1041,7 @@ TIFFWriteRationalArray(TIFF* tif, TIFFDirEntry* dir, float* v) while (fv < 1L<<(31-3) && den < 1L<<(31-3)) fv *= 1<<3, den *= 1L<<3; } - t[2*i+0] = (uint32) (sign * (fv + 0.5)); + t[2*i+0] = (uint32) (sign * (int32)(fv + 0.5)); t[2*i+1] = den; } status = TIFFWriteData(tif, dir, (char *)t); |