diff options
| author | erouault <erouault> | 2017-07-04 13:27:45 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2017-07-04 13:27:45 +0000 |
| commit | 390ae71c95c6182dc4bc5a7f8beca28e8e118007 (patch) | |
| tree | 7ddcd29f9681643d8ee31f6909606bf58ee9b803 | |
| parent | 39905fc96d57d0da76521838dde4d9617618cffd (diff) | |
| download | libtiff-390ae71c95c6182dc4bc5a7f8beca28e8e118007.tar.gz | |
* libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedTileAndAllocBuffer()
and _TIFFReadTileAndAllocBuffer() variants of TIFFReadEncodedTile() and
TIFFReadTile() that allocates the decoded buffer only after a first
successful TIFFFillTile(). This avoids excessive memory allocation
on corrupted files.
* libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
Credit to OSS Fuzz.
| -rw-r--r-- | ChangeLog | 11 |
1 files changed, 11 insertions, 0 deletions
@@ -1,5 +1,16 @@ 2017-07-04 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_read.c, tiffiop.h: add a _TIFFReadEncodedTileAndAllocBuffer() + and _TIFFReadTileAndAllocBuffer() variants of TIFFReadEncodedTile() and + TIFFReadTile() that allocates the decoded buffer only after a first + successful TIFFFillTile(). This avoids excessive memory allocation + on corrupted files. + * libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer(). + Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470 + Credit to OSS Fuzz. + +2017-07-04 Even Rouault <even.rouault at spatialys.com> + * libtiff/tif_error.c, tif_warning.c: correctly use va_list when both an old-style and new-style warning/error handlers are installed. Patch by Paavo Helde (sent on the mailing list) |