diff options
Diffstat (limited to 'libtiff')
-rw-r--r-- | libtiff/tif_ojpeg.c | 15 | ||||
-rw-r--r-- | libtiff/tif_open.c | 1 |
2 files changed, 14 insertions, 2 deletions
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c index ad3e1e71..643bcf23 100644 --- a/libtiff/tif_ojpeg.c +++ b/libtiff/tif_ojpeg.c @@ -1107,6 +1107,12 @@ OJPEGReadHeaderInfo(TIFF* tif) } if (sp->strile_length<sp->image_length) { + if (((sp->subsampling_hor!=1) && (sp->subsampling_hor!=2) && (sp->subsampling_hor!=4)) || + ((sp->subsampling_ver!=1) && (sp->subsampling_ver!=2) && (sp->subsampling_ver!=4))) + { + TIFFErrorExt(tif->tif_clientdata,module,"Invalid subsampling values"); + return(0); + } if (sp->strile_length%(sp->subsampling_ver*8)!=0) { TIFFErrorExt(tif->tif_clientdata,module,"Incompatible vertical subsampling and image strip/tile length"); @@ -2018,10 +2024,15 @@ OJPEGReadBufferFill(OJPEGState* sp) sp->in_buffer_source=osibsEof; else { - sp->in_buffer_file_pos=TIFFGetStrileOffset(sp->tif, sp->in_buffer_next_strile); + int err = 0; + sp->in_buffer_file_pos=TIFFGetStrileOffsetWithErr(sp->tif, sp->in_buffer_next_strile, &err); + if( err ) + return 0; if (sp->in_buffer_file_pos!=0) { - uint64 bytecount = TIFFGetStrileByteCount(sp->tif, sp->in_buffer_next_strile); + uint64 bytecount = TIFFGetStrileByteCountWithErr(sp->tif, sp->in_buffer_next_strile, &err); + if( err ) + return 0; if (sp->in_buffer_file_pos>=sp->file_size) sp->in_buffer_file_pos=0; else if (bytecount==0) diff --git a/libtiff/tif_open.c b/libtiff/tif_open.c index f7b7e0f8..3cb53d4e 100644 --- a/libtiff/tif_open.c +++ b/libtiff/tif_open.c @@ -131,6 +131,7 @@ TIFFClientOpen( if (!readproc || !writeproc || !seekproc || !closeproc || !sizeproc) { TIFFErrorExt(clientdata, module, "One of the client procedures is NULL pointer."); + _TIFFfree(tif); goto bad2; } tif->tif_readproc = readproc; |