94 lines
3.3 KiB
Diff
94 lines
3.3 KiB
Diff
diff -Naur tiff-4.0.1.orig/ChangeLog tiff-4.0.1/ChangeLog
|
|
--- tiff-4.0.1.orig/ChangeLog 2012-02-18 17:02:33.000000000 -0500
|
|
+++ tiff-4.0.1/ChangeLog 2012-05-04 23:33:20.665334408 -0400
|
|
@@ -1,3 +1,8 @@
|
|
+2012-03-30 Frank Warmerdam <warmerdam@google.com>
|
|
+
|
|
+ * tif_getimage.c: Fix size overflow (zdi-can-1221,CVE-2012-1173)
|
|
+ care of Tom Lane @ Red Hat.
|
|
+
|
|
2012-02-18 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
|
|
|
|
* libtiff 4.0.1 released.
|
|
diff -Naur tiff-4.0.1.orig/libtiff/tif_getimage.c tiff-4.0.1/libtiff/tif_getimage.c
|
|
--- tiff-4.0.1.orig/libtiff/tif_getimage.c 2011-02-24 22:34:02.000000000 -0500
|
|
+++ tiff-4.0.1/libtiff/tif_getimage.c 2012-05-04 23:33:20.666334244 -0400
|
|
@@ -1,4 +1,4 @@
|
|
-/* $Id: tif_getimage.c,v 1.78 2011-02-23 21:46:09 fwarmerdam Exp $ */
|
|
+/* $Id: tif_getimage.c,v 1.79 2012-04-06 16:46:46 fwarmerdam Exp $ */
|
|
|
|
/*
|
|
* Copyright (c) 1991-1997 Sam Leffler
|
|
@@ -692,6 +692,7 @@
|
|
unsigned char* p2;
|
|
unsigned char* pa;
|
|
tmsize_t tilesize;
|
|
+ tmsize_t bufsize;
|
|
int32 fromskew, toskew;
|
|
int alpha = img->alpha;
|
|
uint32 nrow;
|
|
@@ -699,12 +700,17 @@
|
|
int colorchannels;
|
|
|
|
tilesize = TIFFTileSize(tif);
|
|
- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
|
|
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);
|
|
+ if (bufsize == 0) {
|
|
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
|
|
+ return (0);
|
|
+ }
|
|
+ buf = (unsigned char*) _TIFFmalloc(bufsize);
|
|
if (buf == 0) {
|
|
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");
|
|
return (0);
|
|
}
|
|
- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
|
|
+ _TIFFmemset(buf, 0, bufsize);
|
|
p0 = buf;
|
|
p1 = p0 + tilesize;
|
|
p2 = p1 + tilesize;
|
|
@@ -917,17 +923,23 @@
|
|
uint32 rowsperstrip, offset_row;
|
|
uint32 imagewidth = img->width;
|
|
tmsize_t stripsize;
|
|
+ tmsize_t bufsize;
|
|
int32 fromskew, toskew;
|
|
int alpha = img->alpha;
|
|
int ret = 1, flip, colorchannels;
|
|
|
|
stripsize = TIFFStripSize(tif);
|
|
- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
|
|
+ bufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,stripsize);
|
|
+ if (bufsize == 0) {
|
|
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
|
|
+ return (0);
|
|
+ }
|
|
+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
|
|
if (buf == 0) {
|
|
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
|
|
return (0);
|
|
}
|
|
- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
|
|
+ _TIFFmemset(buf, 0, bufsize);
|
|
p1 = p0 + stripsize;
|
|
p2 = p1 + stripsize;
|
|
pa = (alpha?(p2+stripsize):NULL);
|
|
diff -Naur tiff-4.0.1.orig/libtiff/tiffiop.h tiff-4.0.1/libtiff/tiffiop.h
|
|
--- tiff-4.0.1.orig/libtiff/tiffiop.h 2011-02-19 11:26:09.000000000 -0500
|
|
+++ tiff-4.0.1/libtiff/tiffiop.h 2012-05-04 23:33:20.667334085 -0400
|
|
@@ -1,4 +1,4 @@
|
|
-/* $Id: tiffiop.h,v 1.82 2011-02-18 20:53:05 fwarmerdam Exp $ */
|
|
+/* $Id: tiffiop.h,v 1.83 2012-04-06 16:46:47 fwarmerdam Exp $ */
|
|
|
|
/*
|
|
* Copyright (c) 1988-1997 Sam Leffler
|
|
@@ -250,7 +250,7 @@
|
|
#define TIFFroundup_64(x, y) (TIFFhowmany_64(x,y)*(y))
|
|
|
|
/* Safe multiply which returns zero if there is an integer overflow */
|
|
-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
|
|
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
|
|
|
|
#define TIFFmax(A,B) ((A)>(B)?(A):(B))
|
|
#define TIFFmin(A,B) ((A)<(B)?(A):(B))
|