diff options
author | erouault <erouault> | 2014-12-24 16:32:28 +0000 |
---|---|---|
committer | erouault <erouault> | 2014-12-24 16:32:28 +0000 |
commit | f7cdda2aeab08298aec48b11c8ce9f99de949c02 (patch) | |
tree | 4d365b8a714100e407ddc3b43631884721f46836 /tools | |
parent | 1adda3b9eda65723a3043d0d8b4f14647f5e9588 (diff) | |
download | libtiff-f7cdda2aeab08298aec48b11c8ce9f99de949c02.tar.gz |
* tools/tiff2pdf.c: fix buffer overflow on some YCbCr JPEG compressed images.
http://bugzilla.maptools.org/show_bug.cgi?id=2445
Diffstat (limited to 'tools')
-rw-r--r-- | tools/tiff2pdf.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index eb2a2dab..400b218f 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -1,4 +1,4 @@ -/* $Id: tiff2pdf.c,v 1.80 2014-12-24 15:38:11 erouault Exp $ +/* $Id: tiff2pdf.c,v 1.81 2014-12-24 16:32:28 erouault Exp $ * * tiff2pdf - converts a TIFF image to a PDF document * @@ -1954,9 +1954,11 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){ } for(i=0;i<stripcount;i++){ k = checkAdd64(k, sbc[i], t2p); - k -=4; /* don't use SOI or EOI of strip */ + k -=2; /* don't use EOI of strip */ + k +=2; /* add space for restart marker */ } k = checkAdd64(k, 2, t2p); /* use EOI of last strip */ + k = checkAdd64(k, 6, t2p); /* for DRI marker of first strip */ t2p->tiff_datasize = (tsize_t) k; if ((uint64) t2p->tiff_datasize != k) { TIFFError(TIFF2PDF_MODULE, "Integer overflow"); |