From 8b1c79e715e24325a713b8b367d2ab262b89b575 Mon Sep 17 00:00:00 2001 From: dron Date: Fri, 25 Feb 2011 15:28:29 +0000 Subject: Avoid undefined behaviour when casting from float to unsigned integer in TIFFWriteRationalArray() as reported by Kareem Shehata. --- ChangeLog | 12 +++++++++--- libtiff/tif_dirwrite.c | 4 ++-- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6e2c7cd5..6f1e8ec9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2011-02-25 Andrey Kiselev + + * libtiff/tif_dirwrite.c: Avoid undefined behaviour when casting from + float to unsigned integer in TIFFWriteRationalArray() as reported by + Kareem Shehata. + 2011-01-03 Lee Howard * libtiff/tif_jpeg.c: Fix regressions with 2 and 3 band images @@ -87,8 +93,8 @@ 2010-12-11 Lee Howard - * libtiff/tif_ojpeg.c: fix buffer overflow on problem data - http://bugzilla.maptools.org/show_bug.cgi?id=1999 + * libtiff/tif_ojpeg.c: fix buffer overflow on problem data + http://bugzilla.maptools.org/show_bug.cgi?id=1999 2010-12-11 Lee Howard @@ -132,7 +138,7 @@ 2010-07-07 Andrey Kiselev - * lintiff/tif_dirread.c: Really reset the tag count in CheckDirCount() + * libtiff/tif_dirread.c: Really reset the tag count in CheckDirCount() to expected value as the warning message suggests. As per bug http://bugzilla.maptools.org/show_bug.cgi?id=1963 diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c index a9f2ec79..6f298399 100644 --- a/libtiff/tif_dirwrite.c +++ b/libtiff/tif_dirwrite.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirwrite.c,v 1.37.2.8 2010-07-06 14:05:30 dron Exp $ */ +/* $Id: tif_dirwrite.c,v 1.37.2.9 2011-02-25 15:28:30 dron Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -1041,7 +1041,7 @@ TIFFWriteRationalArray(TIFF* tif, TIFFDirEntry* dir, float* v) while (fv < 1L<<(31-3) && den < 1L<<(31-3)) fv *= 1<<3, den *= 1L<<3; } - t[2*i+0] = (uint32) (sign * (fv + 0.5)); + t[2*i+0] = (uint32) (sign * (int32)(fv + 0.5)); t[2*i+1] = den; } status = TIFFWriteData(tif, dir, (char *)t); -- cgit v1.2.1