Skip to content
This repository has been archived by the owner on Dec 1, 2017. It is now read-only.
Permalink
Browse files Browse the repository at this point in the history
* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-b…
…ased

buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610
  • Loading branch information
erouault committed Dec 3, 2016
1 parent 296803e commit 787c0ee
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 3 deletions.
7 changes: 7 additions & 0 deletions ChangeLog
@@ -1,3 +1,10 @@
2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: fix uint32 underflow/overflow that can cause heap-based
buffer overflow.
Reported by Agostino Sarubbo.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2610

2016-12-03 Even Rouault <even.rouault at spatialys.com>

* tools/tiffcp.c: avoid potential division by zero is BitsPerSamples tag is
Expand Down
6 changes: 3 additions & 3 deletions tools/tiffcp.c
Expand Up @@ -1163,7 +1163,7 @@ DECLAREcpFunc(cpSeparate2ContigByRow)

static void
cpStripToTile(uint8* out, uint8* in,
uint32 rows, uint32 cols, int outskew, int inskew)
uint32 rows, uint32 cols, int outskew, int64 inskew)
{
while (rows-- > 0) {
uint32 j = cols;
Expand Down Expand Up @@ -1320,7 +1320,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
tdata_t tilebuf;
uint32 imagew = TIFFScanlineSize(in);
uint32 tilew = TIFFTileRowSize(in);
int iskew = imagew - tilew;
int64 iskew = (int64)imagew - (int64)tilew;
uint8* bufp = (uint8*) buf;
uint32 tw, tl;
uint32 row;
Expand Down Expand Up @@ -1348,7 +1348,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
status = 0;
goto done;
}
if (colb + tilew > imagew) {
if (colb > iskew) {
uint32 width = imagew - colb;
uint32 oskew = tilew - width;
cpStripToTile(bufp + colb,
Expand Down

0 comments on commit 787c0ee

Please sign in to comment.