diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2020-02-26 21:21:09 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2020-02-26 21:21:09 +0000 |
| commit | 2832b9829f79bfdc5fa3537ff0267b96f9418712 (patch) | |
| tree | c6c093ff9fa21fbbeb59302e630943bcdc94e506 | |
| parent | e9a124f52ff3669b7201ca10f8b96e392993148e (diff) | |
| parent | 31073933543e6f89397a5c72f5f061a57f2353f4 (diff) | |
| download | libtiff-git-2832b9829f79bfdc5fa3537ff0267b96f9418712.tar.gz | |
Merge branch 'bug2669' into 'master'
tiff2pdf: palette bound check in t2p_sample_realize_palette()
Closes #82
See merge request libtiff/libtiff!104
| -rw-r--r-- | tools/tiff2pdf.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 779c1662..bca54d53 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -3731,6 +3731,11 @@ tsize_t t2p_sample_realize_palette(T2P* t2p, unsigned char* buffer){ for(i=sample_count;i>0;i--){ palette_offset=buffer[i-1] * component_count; sample_offset= (i-1) * component_count; + if(palette_offset + component_count > t2p->pdf_palettesize){ + TIFFError(TIFF2PDF_MODULE, + "Error: palette_offset + component_count > t2p->pdf_palettesize"); + return 1; + } for(j=0;j<component_count;j++){ buffer[sample_offset+j]=t2p->pdf_palette[palette_offset+j]; } |