diff options
| author | Thomas Bernard <miniupnp@free.fr> | 2020-02-08 13:27:51 +0100 |
|---|---|---|
| committer | Thomas Bernard <miniupnp@free.fr> | 2020-02-08 13:27:51 +0100 |
| commit | 31073933543e6f89397a5c72f5f061a57f2353f4 (patch) | |
| tree | e676e0c0d02ef62923b9c9ff9d6a222152f2aabb | |
| parent | 3334704ebcec6a8011fc5ef5d0904d6297a0b9ff (diff) | |
| download | libtiff-git-31073933543e6f89397a5c72f5f061a57f2353f4.tar.gz | |
tiff2pdf: palette bound check in t2p_sample_realize_palette()
fixes #82
| -rw-r--r-- | tools/tiff2pdf.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 779c1662..bca54d53 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -3731,6 +3731,11 @@ tsize_t t2p_sample_realize_palette(T2P* t2p, unsigned char* buffer){ for(i=sample_count;i>0;i--){ palette_offset=buffer[i-1] * component_count; sample_offset= (i-1) * component_count; + if(palette_offset + component_count > t2p->pdf_palettesize){ + TIFFError(TIFF2PDF_MODULE, + "Error: palette_offset + component_count > t2p->pdf_palettesize"); + return 1; + } for(j=0;j<component_count;j++){ buffer[sample_offset+j]=t2p->pdf_palette[palette_offset+j]; } |