Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not dereference

NULL pointer when values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are 0-byte arrays.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression introduced
by previous fix done on 2016-11-11 for CVE-2016-9297).
Reported by Henri Salo.
  • Loading branch information...
erouault
erouault committed Nov 16, 2016
1 parent f64949a commit 89406285f318ffad27af4b200204394b2ee6ba5e
Showing with 11 additions and 2 deletions.
  1. +9 −0 ChangeLog
  2. +2 −2 libtiff/tif_dirread.c
@@ -1,3 +1,12 @@
2016-11-16 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_dirread.c: in TIFFFetchNormalTag(), do not dereference
NULL pointer when values of tags with TIFF_SETGET_C16_ASCII / TIFF_SETGET_C32_ASCII
access are 0-byte arrays.
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2593 (regression introduced
by previous fix done on 2016-11-11 for CVE-2016-9297).
Reported by Henri Salo.

2016-11-12 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

* tools/tiffinfo.c (TIFFReadContigTileData): Fix signed/unsigned
@@ -5000,7 +5000,7 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
if( data[dp->tdir_count-1] != '\0' )
if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
{
TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
data[dp->tdir_count-1] = '\0';
@@ -5177,7 +5177,7 @@ TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
if (err==TIFFReadDirEntryErrOk)
{
int m;
if( data[dp->tdir_count-1] != '\0' )
if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
{
TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
data[dp->tdir_count-1] = '\0';

0 comments on commit 8940628

Please sign in to comment.
You can’t perform that action at this time.