diff options
| author | erouault <erouault> | 2017-07-18 19:45:11 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-07-18 19:45:11 +0000 |
| commit | 13e02541f408b2e7fad7427d3645958d8eff92cc (patch) | |
| tree | 6aa8f01f7e72a53b1d9aaa38972c3108fb1cd565 /libtiff/tif_luv.c | |
| parent | 5276749e99982849fd72771ad4c75d5fd3f7a88f (diff) | |
| download | libtiff-13e02541f408b2e7fad7427d3645958d8eff92cc.tar.gz | |
* libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
allocation when RowsPerStrip tag is missing.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
Credit to OSS-Fuzz
Diffstat (limited to 'libtiff/tif_luv.c')
| -rw-r--r-- | libtiff/tif_luv.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libtiff/tif_luv.c b/libtiff/tif_luv.c index 59d0a74c..0404ec16 100644 --- a/libtiff/tif_luv.c +++ b/libtiff/tif_luv.c @@ -1,4 +1,4 @@ -/* $Id: tif_luv.c,v 1.47 2017-05-14 10:17:27 erouault Exp $ */ +/* $Id: tif_luv.c,v 1.48 2017-07-18 19:45:12 erouault Exp $ */ /* * Copyright (c) 1997 Greg Ward Larson @@ -1416,8 +1416,10 @@ LogLuvInitState(TIFF* tif) } if( isTiled(tif) ) sp->tbuflen = multiply_ms(td->td_tilewidth, td->td_tilelength); - else + else if( td->td_rowsperstrip != (uint32)-1 ) sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_rowsperstrip); + else + sp->tbuflen = multiply_ms(td->td_imagewidth, td->td_imagelength); if (multiply_ms(sp->tbuflen, sizeof (uint32)) == 0 || (sp->tbuf = (uint8*) _TIFFmalloc(sp->tbuflen * sizeof (uint32))) == NULL) { TIFFErrorExt(tif->tif_clientdata, module, "No space for SGILog translation buffer"); |