Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-b…

…ased

buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
  • Loading branch information...
erouault
erouault committed Dec 3, 2016
1 parent 296803e commit 787c0ee906430b772f33ca50b97b8b5ca070faec
Showing with 10 additions and 3 deletions.
  1. +7 −0 ChangeLog
  2. +3 −3 tools/tiffcp.c
@@ -1,3 +1,10 @@
2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
@@ -1163,7 +1163,7 @@ DECLAREcpFunc(cpSeparate2ContigByRow)

static void
cpStripToTile(uint8* out, uint8* in,
uint32 rows, uint32 cols, int outskew, int inskew)
uint32 rows, uint32 cols, int outskew, int64 inskew)
{
while (rows-- > 0) {
uint32 j = cols;
@@ -1320,7 +1320,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
tdata_t tilebuf;
uint32 imagew = TIFFScanlineSize(in);
uint32 tilew = TIFFTileRowSize(in);
int iskew = imagew - tilew;
int64 iskew = (int64)imagew - (int64)tilew;
uint8* bufp = (uint8*) buf;
uint32 tw, tl;
uint32 row;
@@ -1348,7 +1348,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
status = 0;
goto done;
}
if (colb + tilew > imagew) {
if (colb > iskew) {
uint32 width = imagew - colb;
uint32 oskew = tilew - width;
cpStripToTile(bufp + colb,

0 comments on commit 787c0ee

Please sign in to comment.
You can’t perform that action at this time.