From 2b2b304804ee0ff19af05704d4c82998b94ce41b Mon Sep 17 00:00:00 2001
From: erouault <erouault>
Date: Fri, 11 Nov 2016 21:22:50 +0000
Subject: * tools/tiff2pdf.c: avoid undefined behaviour related to overlapping
 of source and destination buffer in memcpy() call in
 t2p_sample_rgbaa_to_rgb() Fixes
 http://bugzilla.maptools.org/show_bug.cgi?id=2577

---
 tools/tiff2pdf.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'tools')

diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
index 6e3c6145..a436b385 100644
--- a/tools/tiff2pdf.c
+++ b/tools/tiff2pdf.c
@@ -1,4 +1,4 @@
-/* $Id: tiff2pdf.c,v 1.95 2016-11-11 21:15:25 erouault Exp $
+/* $Id: tiff2pdf.c,v 1.96 2016-11-11 21:22:50 erouault Exp $
  *
  * tiff2pdf - converts a TIFF image to a PDF document
  *
@@ -3696,7 +3696,12 @@ t2p_sample_rgbaa_to_rgb(tdata_t data, uint32 samplecount)
 {
 	uint32 i;
 	
-	for(i = 0; i < samplecount; i++)
+    /* For the 3 first samples, there is overlapping between souce and
+       destination, so huge memmove().
+       See http://bugzilla.maptools.org/show_bug.cgi?id=2577 */
+    for(i = 0; i < 3 && i < samplecount; i++)
+        memmove((uint8*)data + i * 3, (uint8*)data + i * 4, 3);
+	for(; i < samplecount; i++)
 		memcpy((uint8*)data + i * 3, (uint8*)data + i * 4, 3);
 
 	return(i * 3);
-- 
cgit v1.2.1