diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | tools/rgb2ycbcr.c | 32 | ||||
| -rw-r--r-- | tools/tiff2rgba.c | 25 |
3 files changed, 49 insertions, 13 deletions
@@ -1,5 +1,10 @@ 2009-08-24 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> + * tools/{rgb2ycbcr.c, tiff2rgba.c}: Applied fixes for "Bug 2079 - + CVE-2009-2347 libtiff: integer overflows in various inter-color + space conversion tools". + http://bugzilla.maptools.org/show_bug.cgi?id=2079 + * libtiff/tif_print.c (TIFFPrintDirectory): Apply fix from Jay Berkenbilt for "Bug 2024 - possible null pointer dereference with one-line fix". diff --git a/tools/rgb2ycbcr.c b/tools/rgb2ycbcr.c index 98d6d7dc..70f8ba33 100644 --- a/tools/rgb2ycbcr.c +++ b/tools/rgb2ycbcr.c @@ -1,4 +1,4 @@ -/* $Id: rgb2ycbcr.c,v 1.11 2009-01-22 20:53:07 fwarmerdam Exp $ */ +/* $Id: rgb2ycbcr.c,v 1.12 2009-08-24 17:15:05 bfriesen Exp $ */ /* * Copyright (c) 1991-1997 Sam Leffler @@ -38,6 +38,7 @@ # include "libport.h" #endif +#include "tiffiop.h" #include "tiffio.h" #define streq(a,b) (strcmp(a,b) == 0) @@ -282,15 +283,32 @@ tiffcvt(TIFF* in, TIFF* out) float floatv; char *stringv; uint32 longv; - int result; + int result; + size_t pixel_count; TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width); TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height); - raster = (uint32*)_TIFFmalloc(width * height * sizeof (uint32)); - if (raster == 0) { - TIFFError(TIFFFileName(in), "No space for raster buffer"); - return (0); - } + pixel_count = width * height; + + /* XXX: Check the integer overflow. */ + if (!width || !height || pixel_count / width != height) { + TIFFError(TIFFFileName(in), + "Malformed input file; " + "can't allocate buffer for raster of %lux%lu size", + (unsigned long)width, (unsigned long)height); + return 0; + } + + raster = (uint32*)_TIFFCheckMalloc(in, pixel_count, sizeof(uint32), + "raster buffer"); + if (raster == 0) { + TIFFError(TIFFFileName(in), + "Failed to allocate buffer (%lu elements of %lu each)", + (unsigned long)pixel_count, + (unsigned long)sizeof(uint32)); + return (0); + } + if (!TIFFReadRGBAImage(in, width, height, raster, 0)) { _TIFFfree(raster); return (0); diff --git a/tools/tiff2rgba.c b/tools/tiff2rgba.c index 074cf0f6..bc2f1790 100644 --- a/tools/tiff2rgba.c +++ b/tools/tiff2rgba.c @@ -1,4 +1,4 @@ -/* $Id: tiff2rgba.c,v 1.16 2009-01-22 20:53:07 fwarmerdam Exp $ */ +/* $Id: tiff2rgba.c,v 1.17 2009-08-24 17:15:05 bfriesen Exp $ */ /* * Copyright (c) 1991-1997 Sam Leffler @@ -38,6 +38,7 @@ # include "libport.h" #endif +#include "tiffiop.h" #include "tiffio.h" #define streq(a,b) (strcmp(a,b) == 0) @@ -354,16 +355,27 @@ cvt_whole_image( TIFF *in, TIFF *out ) uint32* raster; /* retrieve RGBA image */ uint32 width, height; /* image width & height */ uint32 row; + size_t pixel_count; TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width); TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height); + pixel_count = width * height; + + /* XXX: Check the integer overflow. */ + if (!width || !height || pixel_count / width != height) { + TIFFError(TIFFFileName(in), + "Malformed input file; can't allocate buffer for raster of %lux%lu size", + (unsigned long)width, (unsigned long)height); + return 0; + } rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip); TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip); - raster = (uint32*)_TIFFmalloc(width * height * sizeof (uint32)); + raster = (uint32*)_TIFFCheckMalloc(in, pixel_count, sizeof(uint32), "raster buffer"); if (raster == 0) { - TIFFError(TIFFFileName(in), "No space for raster buffer"); + TIFFError(TIFFFileName(in), "Failed to allocate buffer (%lu elements of %lu each)", + (unsigned long)pixel_count, (unsigned long)sizeof(uint32)); return (0); } @@ -387,16 +399,17 @@ cvt_whole_image( TIFF *in, TIFF *out ) */ if (no_alpha) { - int pixel_count = width * height; + size_t count = pixel_count; unsigned char *src, *dst; src = dst = (unsigned char *) raster; - while (pixel_count > 0) + while (count > 0) { *(dst++) = *(src++); *(dst++) = *(src++); *(dst++) = *(src++); - src++, pixel_count--; + src++; + count--; } } |