40 lines
1.3 KiB
Diff
40 lines
1.3 KiB
Diff
diff -up tiff-3.9.4/libtiff/tif_getimage.c.CVE-2026-4775 tiff-3.9.4/libtiff/tif_getimage.c
|
|
--- tiff-3.9.4/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-22 13:16:40.507960671 +0200
|
|
+++ tiff-3.9.4/libtiff/tif_getimage.c 2026-04-22 13:19:48.732219288 +0200
|
|
@@ -1656,7 +1656,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
uint32* cp1 = cp+w+toskew;
|
|
uint32* cp2 = cp1+w+toskew;
|
|
uint32* cp3 = cp2+w+toskew;
|
|
- int32 incr = 3*w+4*toskew;
|
|
+ const int64 incr = 3 * (int64)w + 4 * (int64)toskew;
|
|
|
|
(void) y;
|
|
/* adjust fromskew */
|
|
@@ -1751,7 +1751,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
|
|
{
|
|
uint32* cp1 = cp+w+toskew;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const int64 incr = 2 * (int64)toskew + w;
|
|
|
|
(void) y;
|
|
fromskew = (fromskew * 10) / 4;
|
|
@@ -1873,7 +1873,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
|
|
{
|
|
uint32* cp2;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const int64 incr = 2 * (int64)toskew + w;
|
|
(void) y;
|
|
fromskew = (fromskew / 2) * 6;
|
|
cp2 = cp+w+toskew;
|
|
@@ -1967,7 +1967,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
|
|
{
|
|
uint32* cp2;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const int64 incr = 2 * (int64)toskew + w;
|
|
(void) y;
|
|
fromskew = (fromskew / 2) * 4;
|
|
cp2 = cp+w+toskew;
|