Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that

values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are null terminated, to avoid potential read outside buffer
in _TIFFPrintField().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590
  • Loading branch information...
erouault
erouault committed Nov 11, 2016
1 parent 35fc319 commit 30c9234c7fd0dd5e8b1e83ad44370c875a0270ed
Showing with 18 additions and 0 deletions.
  1. +8 −0 ChangeLog
  2. +10 −0 libtiff/tif_dirread.c
@@ -1,3 +1,11 @@
2016-11-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), make sure that
values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are null terminated, to avoid potential read outside buffer
in _TIFFPrintField().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2590

2016-11-11 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: reject images with OJPEG compression that
@@ -5000,6 +5000,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
if( data[dp->tdir_count-1] != '\0' )
{
TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
data[dp->tdir_count-1] = '\0';
}
m=TIFFSetField(tif,dp->tdir_tag,(uint16)(dp->tdir_count),data);
if (data!=0)
_TIFFfree(data);
@@ -5172,6 +5177,11 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
if( data[dp->tdir_count-1] != '\0' )
{
TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
data[dp->tdir_count-1] = '\0';
}
m=TIFFSetField(tif,dp->tdir_tag,(uint32)(dp->tdir_count),data);
if (data!=0)
_TIFFfree(data);

0 comments on commit 30c9234

Please sign in to comment.
You can’t perform that action at this time.