From 7404e78c5cd3150c9f803da533dc79ef33d5b1fe Mon Sep 17 00:00:00 2001 From: tgl Date: Wed, 12 Dec 2012 23:18:05 +0000 Subject: Back-patch recent fixes in TIFFPrintDirectory for field_passcount fields. --- ChangeLog | 6 ++++++ libtiff/tif_print.c | 15 +++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6e2d47cf..8696d6ef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2012-12-12 Tom Lane + + * libtiff/tif_print.c: Back-patch recent fixes in + TIFFPrintDirectory to make it handle field_passcount fields sanely + for both TIFF_VARIABLE and TIFF_VARIABLE2 cases. + 2012-12-10 Tom Lane * tools/ppm2tiff.c: Back-patch fix for CVE-2012-4564. diff --git a/libtiff/tif_print.c b/libtiff/tif_print.c index 7634f6e0..2b255da0 100644 --- a/libtiff/tif_print.c +++ b/libtiff/tif_print.c @@ -1,4 +1,4 @@ -/* $Id: tif_print.c,v 1.36.2.5 2010-07-06 14:05:30 dron Exp $ */ +/* $Id: tif_print.c,v 1.36.2.6 2012-12-12 23:18:05 tgl Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -514,8 +514,19 @@ TIFFPrintDirectory(TIFF* tif, FILE* fd, long flags) continue; if(fip->field_passcount) { - if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1) + if (fip->field_readcount == TIFF_VARIABLE2 ) { + if(TIFFGetField(tif, tag, &value_count, &raw_data) != 1) + continue; + } else if (fip->field_readcount == TIFF_VARIABLE ) { + uint16 small_value_count; + if(TIFFGetField(tif, tag, &small_value_count, &raw_data) != 1) + continue; + value_count = small_value_count; + } else { + assert (fip->field_readcount == TIFF_VARIABLE + || fip->field_readcount == TIFF_VARIABLE2); continue; + } } else { if (fip->field_readcount == TIFF_VARIABLE || fip->field_readcount == TIFF_VARIABLE2) -- cgit v1.2.1