diff options
| author | erouault <erouault> | 2017-04-27 15:46:22 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-04-27 15:46:22 +0000 |
| commit | 258f02f9fb04fbe62917cc90818cde2460156b77 (patch) | |
| tree | ae189eb5eb5851abe95ff7b51f3f6c57afff8b41 | |
| parent | f4248310c1e8a667b6d4d14eefe9c857f1fa8e65 (diff) | |
| download | libtiff-258f02f9fb04fbe62917cc90818cde2460156b77.tar.gz | |
* libtiff/tif_dirread.c: fix memory leak in non DEFER_STRILE_LOAD
mode (ie default) when there is both a StripOffsets and
TileOffsets tag, or a StripByteCounts and TileByteCounts
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2689
* tools/tiff2ps.c: call TIFFClose() in error code paths.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | libtiff/tif_dirread.c | 20 | ||||
| -rw-r--r-- | tools/tiff2ps.c | 8 |
3 files changed, 32 insertions, 3 deletions
@@ -1,3 +1,10 @@ +2017-04-27 + * libtiff/tif_dirread.c: fix memory leak in non DEFER_STRILE_LOAD + mode (ie default) when there is both a StripOffsets and + TileOffsets tag, or a StripByteCounts and TileByteCounts + Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2689 + * tools/tiff2ps.c: call TIFFClose() in error code paths. + 2017-02-25 Even Rouault <even.rouault at spatialys.com> * libtiff/tif_fax3.c, tif_predict.c, tif_getimage.c: fix GCC 7 diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c index f8628fd6..772ebaf7 100644 --- a/libtiff/tif_dirread.c +++ b/libtiff/tif_dirread.c @@ -1,4 +1,4 @@ -/* $Id: tif_dirread.c,v 1.207 2017-01-11 16:09:02 erouault Exp $ */ +/* $Id: tif_dirread.c,v 1.208 2017-04-27 15:46:22 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -3738,6 +3738,14 @@ TIFFReadDirectory(TIFF* tif) _TIFFmemcpy( &(tif->tif_dir.td_stripoffset_entry), dp, sizeof(TIFFDirEntry) ); #else + if( tif->tif_dir.td_stripoffset != NULL ) + { + TIFFErrorExt(tif->tif_clientdata, module, + "tif->tif_dir.td_stripoffset is " + "already allocated. Likely duplicated " + "StripOffsets/TileOffsets tag"); + goto bad; + } if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset)) goto bad; #endif @@ -3748,7 +3756,15 @@ TIFFReadDirectory(TIFF* tif) _TIFFmemcpy( &(tif->tif_dir.td_stripbytecount_entry), dp, sizeof(TIFFDirEntry) ); #else - if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount)) + if( tif->tif_dir.td_stripbytecount != NULL ) + { + TIFFErrorExt(tif->tif_clientdata, module, + "tif->tif_dir.td_stripbytecount is " + "already allocated. Likely duplicated " + "StripByteCounts/TileByteCounts tag"); + goto bad; + } + if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount)) goto bad; #endif break; diff --git a/tools/tiff2ps.c b/tools/tiff2ps.c index 71df4309..f1f0b372 100644 --- a/tools/tiff2ps.c +++ b/tools/tiff2ps.c @@ -1,4 +1,4 @@ -/* $Id: tiff2ps.c,v 1.55 2016-12-17 19:45:28 erouault Exp $ */ +/* $Id: tiff2ps.c,v 1.56 2017-04-27 15:46:22 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -466,10 +466,16 @@ main(int argc, char* argv[]) if (tif != NULL) { if (dirnum != -1 && !TIFFSetDirectory(tif, (tdir_t)dirnum)) + { + TIFFClose(tif); return (-1); + } else if (diroff != 0 && !TIFFSetSubDirectory(tif, diroff)) + { + TIFFClose(tif); return (-1); + } np = TIFF2PS(output, tif, pageWidth, pageHeight, leftmargin, bottommargin, centered); if (np < 0) |