Skip to content
This repository was archived by the owner on Dec 1, 2017. It is now read-only.

Commit 391e77f

Browse files
author
erouault
committed
* libtiff/tif_pixarlog.c: fix potential buffer write overrun in
PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
1 parent c421b99 commit 391e77f

File tree

2 files changed

+13
-0
lines changed

2 files changed

+13
-0
lines changed

Diff for: ChangeLog

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
2016-06-28 Even Rouault <even.rouault at spatialys.com>
2+
3+
* libtiff/tif_pixarlog.c: fix potential buffer write overrun in
4+
PixarLogDecode() on corrupted/unexpected images (reported by Mathias Svensson)
5+
16
2016-06-15 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
27

38
* libtiff/libtiff.def: Added _TIFFMultiply32 and _TIFFMultiply64

Diff for: libtiff/tif_pixarlog.c

+8
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,7 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op,
459459
typedef struct {
460460
TIFFPredictorState predict;
461461
z_stream stream;
462+
tmsize_t tbuf_size; /* only set/used on reading for now */
462463
uint16 *tbuf;
463464
uint16 stride;
464465
int state;
@@ -694,6 +695,7 @@ PixarLogSetupDecode(TIFF* tif)
694695
sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
695696
if (sp->tbuf == NULL)
696697
return (0);
698+
sp->tbuf_size = tbuf_size;
697699
if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN)
698700
sp->user_datafmt = PixarLogGuessDataFmt(td);
699701
if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) {
@@ -783,6 +785,12 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
783785
TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size");
784786
return (0);
785787
}
788+
/* Check that we will not fill more than what was allocated */
789+
if (sp->stream.avail_out > sp->tbuf_size)
790+
{
791+
TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out > sp->tbuf_size");
792+
return (0);
793+
}
786794
do {
787795
int state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
788796
if (state == Z_STREAM_END) {

0 commit comments

Comments
 (0)