diff options
| author | erouault <erouault> | 2016-10-08 15:54:56 +0000 |
|---|---|---|
| committer | erouault <erouault> | 2016-10-08 15:54:56 +0000 |
| commit | cb99cc654213dc3157c776fa68b5ae793bbdd558 (patch) | |
| tree | c2506b4732ea55e8049157cf3358a0d197e25687 /tools | |
| parent | 65fb76c5082e3e25548b733b3404a644e71be03f (diff) | |
| download | libtiff-cb99cc654213dc3157c776fa68b5ae793bbdd558.tar.gz | |
* tools/tiffcp.c: fix out-of-bounds write on tiled images with odd
tile width vs image width. Reported as MSVR 35103
by Axel Souchet and Vishal Chauhan from the MSRC Vulnerabilities &
Mitigations team.
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/tiffcp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/tools/tiffcp.c b/tools/tiffcp.c index 56eca731..338a3d11 100644 --- a/tools/tiffcp.c +++ b/tools/tiffcp.c @@ -1,4 +1,4 @@ -/* $Id: tiffcp.c,v 1.54 2016-10-08 15:04:31 erouault Exp $ */ +/* $Id: tiffcp.c,v 1.55 2016-10-08 15:54:57 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -1338,7 +1338,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer) uint32 colb = 0; uint32 col; - for (col = 0; col < imagewidth; col += tw) { + for (col = 0; col < imagewidth && colb < imagew; col += tw) { if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0 && !ignore) { TIFFError(TIFFFileName(in), @@ -1523,7 +1523,7 @@ DECLAREwriteFunc(writeBufferToContigTiles) uint32 colb = 0; uint32 col; - for (col = 0; col < imagewidth; col += tw) { + for (col = 0; col < imagewidth && colb < imagew; col += tw) { /* * Tile is clipped horizontally. Calculate * visible portion and skewing factors. |