Skip to content
This repository was archived by the owner on Dec 1, 2017. It is now read-only.

Commit 5c08029

Browse files
author
erouault
committed
* tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow and
cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based overflow. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and http://bugzilla.maptools.org/show_bug.cgi?id=2657
1 parent 393881d commit 5c08029

File tree

2 files changed

+29
-2
lines changed

2 files changed

+29
-2
lines changed

Diff for: ChangeLog

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
2017-01-11 Even Rouault <even.rouault at spatialys.com>
2+
3+
* tools/tiffcp.c: error out cleanly in cpContig2SeparateByRow and
4+
cpSeparate2ContigByRow if BitsPerSample != 8 to avoid heap based overflow.
5+
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2656 and
6+
http://bugzilla.maptools.org/show_bug.cgi?id=2657
7+
18
2017-01-11 Even Rouault <even.rouault at spatialys.com>
29

310
* libtiff/tiffio.h, tif_unix.c, tif_win32.c, tif_vms.c: add _TIFFcalloc()

Diff for: tools/tiffcp.c

+22-2
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ static copyFunc pickCopyFunc(TIFF*, TIFF*, uint16, uint16);
591591
static int
592592
tiffcp(TIFF* in, TIFF* out)
593593
{
594-
uint16 bitspersample, samplesperpixel = 1;
594+
uint16 bitspersample = 1, samplesperpixel = 1;
595595
uint16 input_compression, input_photometric = PHOTOMETRIC_MINISBLACK;
596596
copyFunc cf;
597597
uint32 width, length;
@@ -1067,6 +1067,16 @@ DECLAREcpFunc(cpContig2SeparateByRow)
10671067
register uint32 n;
10681068
uint32 row;
10691069
tsample_t s;
1070+
uint16 bps = 0;
1071+
1072+
(void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
1073+
if( bps != 8 )
1074+
{
1075+
TIFFError(TIFFFileName(in),
1076+
"Error, can only handle BitsPerSample=8 in %s",
1077+
"cpContig2SeparateByRow");
1078+
return 0;
1079+
}
10701080

10711081
inbuf = _TIFFmalloc(scanlinesizein);
10721082
outbuf = _TIFFmalloc(scanlinesizeout);
@@ -1120,6 +1130,16 @@ DECLAREcpFunc(cpSeparate2ContigByRow)
11201130
register uint32 n;
11211131
uint32 row;
11221132
tsample_t s;
1133+
uint16 bps = 0;
1134+
1135+
(void) TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
1136+
if( bps != 8 )
1137+
{
1138+
TIFFError(TIFFFileName(in),
1139+
"Error, can only handle BitsPerSample=8 in %s",
1140+
"cpSeparate2ContigByRow");
1141+
return 0;
1142+
}
11231143

11241144
inbuf = _TIFFmalloc(scanlinesizein);
11251145
outbuf = _TIFFmalloc(scanlinesizeout);
@@ -1784,7 +1804,7 @@ pickCopyFunc(TIFF* in, TIFF* out, uint16 bitspersample, uint16 samplesperpixel)
17841804
uint32 w, l, tw, tl;
17851805
int bychunk;
17861806

1787-
(void) TIFFGetField(in, TIFFTAG_PLANARCONFIG, &shortv);
1807+
(void) TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &shortv);
17881808
if (shortv != config && bitspersample != 8 && samplesperpixel > 1) {
17891809
fprintf(stderr,
17901810
"%s: Cannot handle different planar configuration w/ bits/sample != 8\n",

0 commit comments

Comments
 (0)