diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2019-08-22 10:19:44 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2019-08-22 10:19:44 +0200 |
| commit | c8f268ef1b8d7a37212ce6e62c0dd23e2f37eb47 (patch) | |
| tree | 791b5981f38cf1ecd8c0ae79e2cf3d74fb07a278 | |
| parent | 761d50e34da15e969c5556b796c97595faa2efb6 (diff) | |
| download | libtiff-git-c8f268ef1b8d7a37212ce6e62c0dd23e2f37eb47.tar.gz | |
EstimateStripByteCounts(): avoid unsigned integer overflow
| -rw-r--r-- | libtiff/tif_dirread.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index 7756e107..87bc030e 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -4549,6 +4549,8 @@ EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount) dp->tdir_type); return -1; } + if( dp->tdir_count > TIFF_UINT64_MAX / typewidth ) + return -1; datasize=(uint64)typewidth*dp->tdir_count; if (!(tif->tif_flags&TIFF_BIGTIFF)) { |