diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2019-08-23 12:28:25 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2019-08-23 12:28:25 +0200 |
| commit | c9edebfdb039aa1be08561108a0b15175f4e5caa (patch) | |
| tree | 5de04e08abf846ff32db913b1a3361bf9df618cc | |
| parent | f277541bd8b5facbf4cd76291d0aea1a5538479b (diff) | |
| download | libtiff-git-c9edebfdb039aa1be08561108a0b15175f4e5caa.tar.gz | |
tif_thunder: avoid unsigned integer overflow (not a bug). Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16632
| -rw-r--r-- | libtiff/tif_thunder.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/libtiff/tif_thunder.c b/libtiff/tif_thunder.c index 2388dbb6..db6383a8 100644 --- a/libtiff/tif_thunder.c +++ b/libtiff/tif_thunder.c @@ -122,17 +122,17 @@ ThunderDecode(TIFF* tif, uint8* op, tmsize_t maxpixels) break; case THUNDER_2BITDELTAS: /* 2-bit deltas */ if ((delta = ((n >> 4) & 3)) != DELTA2_SKIP) - SETPIXEL(op, lastpixel + twobitdeltas[delta]); + SETPIXEL(op, (unsigned)((int)lastpixel + twobitdeltas[delta])); if ((delta = ((n >> 2) & 3)) != DELTA2_SKIP) - SETPIXEL(op, lastpixel + twobitdeltas[delta]); + SETPIXEL(op, (unsigned)((int)lastpixel + twobitdeltas[delta])); if ((delta = (n & 3)) != DELTA2_SKIP) - SETPIXEL(op, lastpixel + twobitdeltas[delta]); + SETPIXEL(op, (unsigned)((int)lastpixel + twobitdeltas[delta])); break; case THUNDER_3BITDELTAS: /* 3-bit deltas */ if ((delta = ((n >> 3) & 7)) != DELTA3_SKIP) - SETPIXEL(op, lastpixel + threebitdeltas[delta]); + SETPIXEL(op, (unsigned)((int)lastpixel + threebitdeltas[delta])); if ((delta = (n & 7)) != DELTA3_SKIP) - SETPIXEL(op, lastpixel + threebitdeltas[delta]); + SETPIXEL(op, (unsigned)((int)lastpixel + threebitdeltas[delta])); break; case THUNDER_RAW: /* raw data */ SETPIXEL(op, n); |