Skip to content
This repository has been archived by the owner on Dec 1, 2017. It is now read-only.
Permalink
Browse files Browse the repository at this point in the history
* tools/tiff2pdf.c: avoid potential heap-based overflow in
t2p_readwrite_pdf_image_tile().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640
  • Loading branch information
erouault committed Dec 20, 2016
1 parent 891b1b9 commit c715336
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 1 deletion.
6 changes: 6 additions & 0 deletions ChangeLog
@@ -1,3 +1,9 @@
2016-12-20 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: avoid potential heap-based overflow in
t2p_readwrite_pdf_image_tile().
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640

2016-12-20 Even Rouault <even.rouault at spatialys.com>

* tools/tiff2pdf.c: avoid potential invalid memory read in
Expand Down
2 changes: 1 addition & 1 deletion tools/tiff2pdf.c
Expand Up @@ -2895,7 +2895,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
return(0);
}
if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
if (count >= 4) {
if (count > 4) {
int retTIFFReadRawTile;
/* Ignore EOI marker of JpegTables */
_TIFFmemcpy(buffer, jpt, count - 2);
Expand Down

0 comments on commit c715336

Please sign in to comment.