HCoop / jackhill / guix / guix.git / blame
| Commit | Line | Data |
|---|---|---|
| 4b96149d LF |
1 | Fix invalid read in t2p_writeproc(): |
| 2 | ||
| 3 | http://bugzilla.maptools.org/show_bug.cgi?id=2639 | |
| 4 | ||
| 5 | 2016-12-20 Even Rouault <even.rouault at spatialys.com> | |
| 6 | ||
| 7 | * tools/tiff2pdf.c: avoid potential invalid memory read in | |
| 8 | t2p_writeproc. | |
| 9 | Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639 | |
| 10 | ||
| 11 | ||
| 12 | /cvs/maptools/cvsroot/libtiff/ChangeLog,v <-- ChangeLog | |
| 13 | new revision: 1.1198; previous revision: 1.1197 | |
| 14 | /cvs/maptools/cvsroot/libtiff/tools/tiff2pdf.c,v <-- tools/tiff2pdf.c | |
| 15 | new revision: 1.100; previous revision: 1.99 | |
| 16 | ||
| 17 | Index: libtiff/tools/tiff2pdf.c | |
| 18 | =================================================================== | |
| 19 | RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiff2pdf.c,v | |
| 20 | retrieving revision 1.99 | |
| 21 | retrieving revision 1.100 | |
| 22 | diff -u -r1.99 -r1.100 | |
| 23 | --- libtiff/tools/tiff2pdf.c 20 Dec 2016 17:13:26 -0000 1.99 | |
| 24 | +++ libtiff/tools/tiff2pdf.c 20 Dec 2016 17:24:35 -0000 1.100 | |
| 25 | @@ -2896,6 +2896,7 @@ | |
| 26 | } | |
| 27 | if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { | |
| 28 | if (count >= 4) { | |
| 29 | + int retTIFFReadRawTile; | |
| 30 | /* Ignore EOI marker of JpegTables */ | |
| 31 | _TIFFmemcpy(buffer, jpt, count - 2); | |
| 32 | bufferoffset += count - 2; | |
| 33 | @@ -2903,22 +2904,23 @@ | |
| 34 | table_end[0] = buffer[bufferoffset-2]; | |
| 35 | table_end[1] = buffer[bufferoffset-1]; | |
| 36 | xuint32 = bufferoffset; | |
| 37 | - bufferoffset -= 2; | |
| 38 | - bufferoffset += TIFFReadRawTile( | |
| 39 | + bufferoffset -= 2; | |
| 40 | + retTIFFReadRawTile= TIFFReadRawTile( | |
| 41 | input, | |
| 42 | tile, | |
| 43 | (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), | |
| 44 | -1); | |
| 45 | + if( retTIFFReadRawTile < 0 ) | |
| 46 | + { | |
| 47 | + _TIFFfree(buffer); | |
| 48 | + t2p->t2p_error = T2P_ERR_ERROR; | |
| 49 | + return(0); | |
| 50 | + } | |
| 51 | + bufferoffset += retTIFFReadRawTile; | |
| 52 | /* Overwrite SOI marker of image scan with previously */ | |
| 53 | /* saved end of JpegTables */ | |
| 54 | buffer[xuint32-2]=table_end[0]; | |
| 55 | buffer[xuint32-1]=table_end[1]; | |
| 56 | - } else { | |
| 57 | - bufferoffset += TIFFReadRawTile( | |
| 58 | - input, | |
| 59 | - tile, | |
| 60 | - (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), | |
| 61 | - -1); | |
| 62 | } | |
| 63 | } | |
| 64 | t2pWriteFile(output, (tdata_t) buffer, bufferoffset); |