* tools/rgb2ycbcr.c: validate values of -v and -h parameters to

avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)

2 files changed, 10 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 5d606087..3e6642a3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
 2016-08-15 Even Rouault <even.rouault at spatialys.com>
 
+	* tools/rgb2ycbcr.c: validate values of -v and -h parameters to
+	avoid potential divide by zero. Fixes CVE-2016-3623 (bugzilla #2569)
+
+2016-08-15 Even Rouault <even.rouault at spatialys.com>
+
 	* tools/tiffcrop.c: Fix out-of-bounds write in loadImage().
 	From patch libtiff-CVE-2016-3991.patch from
 	libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro (bugzilla #2543)
diff --git a/tools/rgb2ycbcr.c b/tools/rgb2ycbcr.c
index 4a969c2c..7a9d705e 100644
--- a/tools/rgb2ycbcr.c
+++ b/tools/rgb2ycbcr.c
@@ -1,4 +1,4 @@
-/* $Id: rgb2ycbcr.c,v 1.16 2015-06-21 01:09:10 bfriesen Exp $ */
+/* $Id: rgb2ycbcr.c,v 1.17 2016-08-15 21:26:56 erouault Exp $ */
 
 /*
  * Copyright (c) 1991-1997 Sam Leffler
@@ -95,9 +95,13 @@ main(int argc, char* argv[])
 			break;
 		case 'h':
 			horizSubSampling = atoi(optarg);
+            if( horizSubSampling != 1 && horizSubSampling != 2 && horizSubSampling != 4 )
+                usage(-1);
 			break;
 		case 'v':
 			vertSubSampling = atoi(optarg);
+            if( vertSubSampling != 1 && vertSubSampling != 2 && vertSubSampling != 4 )
+                usage(-1);
 			break;
 		case 'r':
 			rowsperstrip = atoi(optarg);