* libtiff/tif_dirread.c: reject images with OJPEG compression that

have no TileOffsets/StripOffsets tag, when OJPEG compression is
disabled. Prevent null pointer dereference in TIFFReadRawStrip1()
and other functions that expect td_stripbytecount to be non NULL.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585

2 files changed, 13 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index b642c7ce..079068e0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-11-11 Even Rouault <even.rouault at spatialys.com>
 
+	* libtiff/tif_dirread.c: reject images with OJPEG compression that
+	have no TileOffsets/StripOffsets tag, when OJPEG compression is
+	disabled. Prevent null pointer dereference in TIFFReadRawStrip1()
+	and other functions that expect td_stripbytecount to be non NULL.
+	Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2585
+
+2016-11-11 Even Rouault <even.rouault at spatialys.com>
+
 	* tools/tiffcrop.c: fix multiple uint32 overflows in
 	writeBufferToSeparateStrips(), writeBufferToContigTiles() and
 	writeBufferToSeparateTiles() that could cause heap buffer overflows.
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 0a7e6830..99c5b206 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -1,4 +1,4 @@
-/* $Id: tif_dirread.c,v 1.201 2016-04-27 11:38:00 erouault Exp $ */
+/* $Id: tif_dirread.c,v 1.202 2016-11-11 20:01:55 erouault Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -3628,6 +3628,7 @@ TIFFReadDirectory(TIFF* tif)
 	if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
 		tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
 	if (!TIFFFieldSet(tif, FIELD_STRIPOFFSETS)) {
+#ifdef OJPEG_SUPPORT
 		if ((tif->tif_dir.td_compression==COMPRESSION_OJPEG) &&
 		    (isTiled(tif)==0) &&
 		    (tif->tif_dir.td_nstrips==1)) {
@@ -3640,7 +3641,9 @@ TIFFReadDirectory(TIFF* tif)
 			 * JpegInterchangeFormat stream.
 			 */
 			TIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);
-		} else {
+		} else
+#endif
+        {
 			MissingRequired(tif,
 				isTiled(tif) ? "TileOffsets" : "StripOffsets");
 			goto bad;