diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2016-06-28 15:12:19 +0000 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2016-06-28 15:12:19 +0000 |
| commit | bf5b698868b0b16f14cc03d83d74cdcd9e98983e (patch) | |
| tree | 5af4af99874e5a2fbd794bf15f8e3a7c91b76a23 /libtiff/tif_pixarlog.c | |
| parent | c0eb1847f4d5b6abfa034237331beee3b05580f5 (diff) | |
| download | libtiff-git-bf5b698868b0b16f14cc03d83d74cdcd9e98983e.tar.gz | |
* libtiff/tif_pixarlog.c: fix potential buffer write overrun in
PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
Diffstat (limited to 'libtiff/tif_pixarlog.c')
| -rw-r--r-- | libtiff/tif_pixarlog.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c index fe258292..5c1d5a02 100644 --- a/libtiff/tif_pixarlog.c +++ b/libtiff/tif_pixarlog.c @@ -1,4 +1,4 @@ -/* $Id: tif_pixarlog.c,v 1.43 2015-12-27 20:14:11 erouault Exp $ */ +/* $Id: tif_pixarlog.c,v 1.44 2016-06-28 15:12:19 erouault Exp $ */ /* * Copyright (c) 1996-1997 Sam Leffler @@ -459,6 +459,7 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op, typedef struct { TIFFPredictorState predict; z_stream stream; + tmsize_t tbuf_size; /* only set/used on reading for now */ uint16 *tbuf; uint16 stride; int state; @@ -694,6 +695,7 @@ PixarLogSetupDecode(TIFF* tif) sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size); if (sp->tbuf == NULL) return (0); + sp->tbuf_size = tbuf_size; if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) sp->user_datafmt = PixarLogGuessDataFmt(td); if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) { @@ -783,6 +785,12 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s) TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size"); return (0); } + /* Check that we will not fill more than what was allocated */ + if (sp->stream.avail_out > sp->tbuf_size) + { + TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out > sp->tbuf_size"); + return (0); + } do { int state = inflate(&sp->stream, Z_PARTIAL_FLUSH); if (state == Z_STREAM_END) { |