diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2016-08-15 20:49:48 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2016-08-15 20:49:48 +0000 |
| commit | a71b62bcff784cb86a8f81878f760cb2bcba66e6 (patch) | |
| tree | 90922ac55909aed18bcd362c0d5606a6eb606611 /libtiff/tif_pixarlog.c | |
| parent | 01bac25a5a9fa0bc41b90a83eca3026e351d818d (diff) | |
| download | libtiff-git-a71b62bcff784cb86a8f81878f760cb2bcba66e6.tar.gz | |
* libtiff/tif_pixarlog.c: Fix write buffer overflow in PixarLogEncode
if more input samples are provided than expected by PixarLogSetupEncode.
Idea based on libtiff-CVE-2016-3990.patch from
libtiff-4.0.3-25.el7_2.src.rpm by Nikola Forro, but with different and
simpler check. (bugzilla #2544)
invalid tests that rejected valid files. (bugzilla #2545)
Diffstat (limited to 'libtiff/tif_pixarlog.c')
| -rw-r--r-- | libtiff/tif_pixarlog.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c index 9bffccfb..47df14ce 100644 --- a/libtiff/tif_pixarlog.c +++ b/libtiff/tif_pixarlog.c @@ -1,4 +1,4 @@ -/* $Id: tif_pixarlog.c,v 1.45 2016-06-28 15:37:33 erouault Exp $ */ +/* $Id: tif_pixarlog.c,v 1.46 2016-08-15 20:49:48 erouault Exp $ */ /* * Copyright (c) 1996-1997 Sam Leffler @@ -1141,6 +1141,13 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s) } llen = sp->stride * td->td_imagewidth; + /* Check against the number of elements (of size uint16) of sp->tbuf */ + if( n > td->td_rowsperstrip * llen ) + { + TIFFErrorExt(tif->tif_clientdata, module, + "Too many input bytes provided"); + return 0; + } for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) { switch (sp->user_datafmt) { |