Skip to content
This repository was archived by the owner on Dec 1, 2017. It is now read-only.

Commit 438274f

Browse files
author
erouault
committed
* libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
TIFFReadEncodedStrip() that caused an integer division by zero. Reported by Agostino Sarubbo. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
1 parent fa6aff6 commit 438274f

File tree

3 files changed

+12
-1
lines changed

3 files changed

+12
-1
lines changed

Diff for: ChangeLog

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
2016-12-02 Even Rouault <even.rouault at spatialys.com>
2+
3+
* libtiff/tif_read.c, libtiff/tiffiop.h: fix uint32 overflow in
4+
TIFFReadEncodedStrip() that caused an integer division by zero.
5+
Reported by Agostino Sarubbo.
6+
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2596
7+
18
2016-11-20 Even Rouault <even.rouault at spatialys.com>
29

310
* libtiff/tif_getimage.c, libtiff/tif_open.c: add parenthesis to

Diff for: libtiff/tif_read.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@ TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
346346
rowsperstrip=td->td_rowsperstrip;
347347
if (rowsperstrip>td->td_imagelength)
348348
rowsperstrip=td->td_imagelength;
349-
stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
349+
stripsperplane= TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
350350
stripinplane=(strip%stripsperplane);
351351
plane=(uint16)(strip/stripsperplane);
352352
rows=td->td_imagelength-stripinplane*rowsperstrip;

Diff for: libtiff/tiffiop.h

+4
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,10 @@ struct tiff {
250250
#define TIFFhowmany_32(x, y) (((uint32)x < (0xffffffff - (uint32)(y-1))) ? \
251251
((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y))) : \
252252
0U)
253+
/* Variant of TIFFhowmany_32() that doesn't return 0 if x close to MAXUINT. */
254+
/* Caution: TIFFhowmany_32_maxuint_compat(x,y)*y might overflow */
255+
#define TIFFhowmany_32_maxuint_compat(x, y) \
256+
(((uint32)(x) / (uint32)(y)) + ((((uint32)(x) % (uint32)(y)) != 0) ? 1 : 0))
253257
#define TIFFhowmany8_32(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
254258
#define TIFFroundup_32(x, y) (TIFFhowmany_32(x,y)*(y))
255259
#define TIFFhowmany_64(x, y) ((((uint64)(x))+(((uint64)(y))-1))/((uint64)(y)))

0 commit comments

Comments
 (0)