From 31073933543e6f89397a5c72f5f061a57f2353f4 Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Sat, 8 Feb 2020 13:27:51 +0100
Subject: tiff2pdf: palette bound check in t2p_sample_realize_palette()

fixes #82
---
 tools/tiff2pdf.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
index 779c1662..bca54d53 100644
--- a/tools/tiff2pdf.c
+++ b/tools/tiff2pdf.c
@@ -3731,6 +3731,11 @@ tsize_t t2p_sample_realize_palette(T2P* t2p, unsigned char* buffer){
 	for(i=sample_count;i>0;i--){
 		palette_offset=buffer[i-1] * component_count;
 		sample_offset= (i-1) * component_count;
+		if(palette_offset + component_count > t2p->pdf_palettesize){
+			TIFFError(TIFF2PDF_MODULE,
+				"Error: palette_offset + component_count > t2p->pdf_palettesize");
+			return 1;
+		}
 		for(j=0;j<component_count;j++){
 			buffer[sample_offset+j]=t2p->pdf_palette[palette_offset+j];
 		}
-- 
cgit v1.2.1