40 lines
1.4 KiB
Diff
40 lines
1.4 KiB
Diff
diff -up tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775 tiff-4.0.9/libtiff/tif_getimage.c
|
|
--- tiff-4.0.9/libtiff/tif_getimage.c.CVE-2026-4775 2026-04-20 14:46:44.329742232 +0200
|
|
+++ tiff-4.0.9/libtiff/tif_getimage.c 2026-04-20 14:46:44.337742095 +0200
|
|
@@ -1900,7 +1900,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
uint32* cp1 = cp+w+toskew;
|
|
uint32* cp2 = cp1+w+toskew;
|
|
uint32* cp3 = cp2+w+toskew;
|
|
- int32 incr = 3*w+4*toskew;
|
|
+ const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew;
|
|
|
|
(void) y;
|
|
/* adjust fromskew */
|
|
@@ -2004,7 +2004,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
|
|
{
|
|
uint32* cp1 = cp+w+toskew;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
|
|
(void) y;
|
|
fromskew = (fromskew / 4) * (4*2+2);
|
|
@@ -2130,7 +2130,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr4
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
|
|
{
|
|
uint32* cp2;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
(void) y;
|
|
fromskew = (fromskew / 2) * (2*2+2);
|
|
cp2 = cp+w+toskew;
|
|
@@ -2225,7 +2225,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr2
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
|
|
{
|
|
uint32* cp2;
|
|
- int32 incr = 2*toskew+w;
|
|
+ const tmsize_t incr = 2 * (tmsize_t)toskew + w;
|
|
(void) y;
|
|
fromskew = (fromskew / 1) * (1 * 2 + 2);
|
|
cp2 = cp+w+toskew;
|