Skip to content
This repository was archived by the owner on Dec 1, 2017. It is now read-only.

Commit 43c0b81

Browse files
author
erouault
committed
* tools/tiffcp.c: fix read of undefined variable in case of missing
required tags. Found on test case of MSVR 35100. * tools/tiffcrop.c: fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16 overflow. Probably not a security issue but I can be wrong. Reported as MSVR 35100 by Axel Souchet from the MSRC Vulnerabilities & Mitigations team.
1 parent 66a75ab commit 43c0b81

File tree

3 files changed

+17
-5
lines changed

3 files changed

+17
-5
lines changed

Diff for: ChangeLog

+9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
2016-10-08 Even Rouault <even.rouault at spatialys.com>
2+
3+
* tools/tiffcp.c: fix read of undefined variable in case of missing
4+
required tags. Found on test case of MSVR 35100.
5+
* tools/tiffcrop.c: fix read of undefined buffer in
6+
readContigStripsIntoBuffer() due to uint16 overflow. Probably not a
7+
security issue but I can be wrong. Reported as MSVR 35100 by Axel
8+
Souchet from the MSRC Vulnerabilities & Mitigations team.
9+
110
2016-09-25 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
211

312
* html: Change as many remotesensing.org broken links to a working

Diff for: tools/tiffcp.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -592,8 +592,8 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
592592
static int
593593
tiffcp(TIFF* in, TIFF* out)
594594
{
595-
uint16 bitspersample, samplesperpixel;
596-
uint16 input_compression, input_photometric;
595+
uint16 bitspersample, samplesperpixel = 1;
596+
uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
597597
copyFunc cf;
598598
uint32 width, length;
599599
struct cpTag* p;

Diff for: tools/tiffcrop.c

+6-3
Original file line numberDiff line numberDiff line change
@@ -3628,7 +3628,7 @@ static int readContigStripsIntoBuffer (TIFF* in, uint8* buf)
36283628
{
36293629
uint8* bufp = buf;
36303630
int32 bytes_read = 0;
3631-
uint16 strip, nstrips = TIFFNumberOfStrips(in);
3631+
uint32 strip, nstrips = TIFFNumberOfStrips(in);
36323632
uint32 stripsize = TIFFStripSize(in);
36333633
uint32 rows = 0;
36343634
uint32 rps = TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
@@ -4711,9 +4711,12 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
47114711
uint32 width, uint16 spp,
47124712
struct dump_opts *dump)
47134713
{
4714-
int i, j, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
4714+
int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
4715+
uint32 j;
47154716
int32 bytes_read = 0;
4716-
uint16 bps, nstrips, planar, strips_per_sample;
4717+
uint16 bps, planar;
4718+
uint32 nstrips;
4719+
uint32 strips_per_sample;
47174720
uint32 src_rowsize, dst_rowsize, rows_processed, rps;
47184721
uint32 rows_this_strip = 0;
47194722
tsample_t s;

0 commit comments

Comments
 (0)