You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
50 lines
1.6 KiB
50 lines
1.6 KiB
7 years ago
|
From d7045ed1501ec99c4e56174813bb1cb5c9a559ef Mon Sep 17 00:00:00 2001
|
||
|
From: Even Rouault <even.rouault@spatialys.com>
|
||
|
Date: Sat, 3 Dec 2016 12:19:32 +0000
|
||
|
Subject: [PATCH] * tools/tiffcrop.c: add 3 extra bytes at end of strip buffer
|
||
|
in readSeparateStripsIntoBuffer() to avoid read outside of heap allocated
|
||
|
buffer. Reported by Agostina Sarubo. Fixes
|
||
|
http://bugzilla.maptools.org/show_bug.cgi?id=2621
|
||
|
|
||
|
---
|
||
|
ChangeLog | 7 +++++++
|
||
|
tools/tiffcrop.c | 14 ++++++++++++--
|
||
|
2 files changed, 19 insertions(+), 2 deletions(-)
|
||
|
|
||
|
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
|
||
|
index bdcbd63ed70b..9122aab37530 100644
|
||
|
--- a/tools/tiffcrop.c
|
||
|
+++ b/tools/tiffcrop.c
|
||
|
@@ -4815,10 +4815,17 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
|
||
|
nstrips = TIFFNumberOfStrips(in);
|
||
|
strips_per_sample = nstrips /spp;
|
||
|
|
||
|
+ /* Add 3 padding bytes for combineSeparateSamples32bits */
|
||
|
+ if( (size_t) stripsize > 0xFFFFFFFFU - 3U )
|
||
|
+ {
|
||
|
+ TIFFError("readSeparateStripsIntoBuffer", "Integer overflow when calculating buffer size.");
|
||
|
+ exit(-1);
|
||
|
+ }
|
||
|
+
|
||
|
for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
|
||
|
{
|
||
|
srcbuffs[s] = NULL;
|
||
|
- buff = _TIFFmalloc(stripsize);
|
||
|
+ buff = _TIFFmalloc(stripsize + 3);
|
||
|
if (!buff)
|
||
|
{
|
||
|
TIFFError ("readSeparateStripsIntoBuffer",
|
||
|
@@ -4827,6 +4834,9 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
|
||
|
_TIFFfree (srcbuffs[i]);
|
||
|
return 0;
|
||
|
}
|
||
|
+ buff[stripsize] = 0;
|
||
|
+ buff[stripsize+1] = 0;
|
||
|
+ buff[stripsize+2] = 0;
|
||
|
srcbuffs[s] = buff;
|
||
|
}
|
||
|
|
||
|
--
|
||
|
2.12.0
|
||
|
|