* libtiff/tif_getimage.c: avoid divide by zero on invalid YCbCr subsa…

…mpling. http://bugzilla.maptools.org/show_bug.cgi?id=2235
vadz · Dec 24, 2014 · 24a2eee · 24a2eee
1 parent 529c4d6
commit 24a2eee
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-24  Even Rouault  <even.rouault@spatialys.com>
+
+	* libtiff/tif_getimage.c: avoid divide by zero on invalid YCbCr subsampling.
+	http://bugzilla.maptools.org/show_bug.cgi?id=2235
+
 2014-12-24  Even Rouault  <even.rouault@spatialys.com>
 
 	* tools/tiff2pdf.c: fix buffer overflow on some YCbCr JPEG compressed images.

diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
@@ -875,6 +875,10 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
 
 	TIFFGetFieldDefaulted(tif, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
 	TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);
+	if( subsamplingver == 0 ) {
+		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Invalid vertical YCbCr subsampling");
+		return (0);
+	}
 	scanline = TIFFScanlineSize(tif);
 	fromskew = (w < imagewidth ? imagewidth - w : 0);
 	for (row = 0; row < h; row += nrow)