diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2016-11-11 20:45:53 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2016-11-11 20:45:53 +0000 |
| commit | 56f3e29d187c7e7508890f5643a2adfbb83120a5 (patch) | |
| tree | e43e52e766d633d49071906ffa5bd267b356eff1 | |
| parent | 9bddab50357a22087f177808be11116f97e99fcb (diff) | |
| download | libtiff-git-56f3e29d187c7e7508890f5643a2adfbb83120a5.tar.gz | |
* libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted()
when requesting Predictor tag and that the zip/lzw codec is not
configured.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | libtiff/tif_aux.c | 19 |
2 files changed, 20 insertions, 6 deletions
@@ -1,5 +1,12 @@ 2016-11-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_aux.c: fix crash in TIFFVGetFieldDefaulted() + when requesting Predictor tag and that the zip/lzw codec is not + configured. + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2591 + +2016-11-11 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII access are null terminated, to avoid potential read outside buffer diff --git a/libtiff/tif_aux.c b/libtiff/tif_aux.c index fb6ece1d..3d35ba92 100644 --- a/libtiff/tif_aux.c +++ b/libtiff/tif_aux.c @@ -1,4 +1,4 @@ -/* $Id: tif_aux.c,v 1.28 2016-01-23 21:20:34 erouault Exp $ */ +/* $Id: tif_aux.c,v 1.29 2016-11-11 20:45:53 erouault Exp $ */ /* * Copyright (c) 1991-1997 Sam Leffler @@ -212,11 +212,18 @@ TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap) *va_arg(ap, uint16 *) = td->td_resolutionunit; return (1); case TIFFTAG_PREDICTOR: - { - TIFFPredictorState* sp = (TIFFPredictorState*) tif->tif_data; - *va_arg(ap, uint16*) = (uint16) sp->predictor; - return 1; - } + { + TIFFPredictorState* sp = (TIFFPredictorState*) tif->tif_data; + if( sp == NULL ) + { + TIFFErrorExt(tif->tif_clientdata, tif->tif_name, + "Cannot get \"Predictor\" tag as plugin is not configured"); + *va_arg(ap, uint16*) = 0; + return 0; + } + *va_arg(ap, uint16*) = (uint16) sp->predictor; + return 1; + } case TIFFTAG_DOTRANGE: *va_arg(ap, uint16 *) = 0; *va_arg(ap, uint16 *) = (1<<td->td_bitspersample)-1; |