diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2016-11-11 20:22:01 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2016-11-11 20:22:01 +0000 |
| commit | 9bddab50357a22087f177808be11116f97e99fcb (patch) | |
| tree | 0563a04481b07c8164108cc82d256e3107320f6b /libtiff/tif_dirread.c | |
| parent | 1120426ba0d08571db27aae0e02d99faae68b85d (diff) | |
| download | libtiff-git-9bddab50357a22087f177808be11116f97e99fcb.tar.gz | |
* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that
values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are null terminated, to avoid potential read outside buffer
in _TIFFPrintField().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590
Diffstat (limited to 'libtiff/tif_dirread.c')
| -rw-r--r-- | libtiff/tif_dirread.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index 99c5b206..0ed3afa2 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirread.c,v 1.202 2016-11-11 20:01:55 erouault Exp $ */ +/* $Id: tif_dirread.c,v 1.203 2016-11-11 20:22:01 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -5000,6 +5000,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover) if (err==TIFFReadDirEntryErrOk) { int m; + if( data[dp->tdir_count-1] != '\0' ) + { + TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name); + data[dp->tdir_count-1] = '\0'; + } m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data); if (data!=0) _TIFFfree(data); @@ -5172,6 +5177,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover) if (err==TIFFReadDirEntryErrOk) { int m; + if( data[dp->tdir_count-1] != '\0' ) + { + TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name); + data[dp->tdir_count-1] = '\0'; + } m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data); if (data!=0) _TIFFfree(data); |