Skip to content
This repository has been archived by the owner. It is now read-only.
Permalink
Browse files

* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_ns…

…trips

value when it is non-zero, instead of recomputing it. This is needed in
TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of
array in tiffsplit (or other utilities using TIFFNumberOfStrips()).
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587
  • Loading branch information...
erouault
erouault committed Nov 9, 2016
1 parent 6a984bf commit d651abc097d91fac57f33b5f9447d0a9183f58e7
Showing with 17 additions and 0 deletions.
  1. +8 −0 ChangeLog
  2. +9 −0 libtiff/tif_strip.c
@@ -1,3 +1,11 @@
2016-11-10 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_strip.c: make TIFFNumberOfStrips() return the td->td_nstrips
value when it is non-zero, instead of recomputing it. This is needed in
TIFF_STRIPCHOP mode where td_nstrips is modified. Fixes a read outsize of
array in tiffsplit (or other utilities using TIFFNumberOfStrips()).
Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2587

2016-11-04 Even Rouault <even.rouault at spatialys.com>

* libtiff/tif_predic.c: fix memory leaks in error code paths added in
@@ -63,6 +63,15 @@ TIFFNumberOfStrips(TIFF* tif)
TIFFDirectory *td = &tif->tif_dir;
uint32 nstrips;

/* If the value was already computed and store in td_nstrips, then return it,
since ChopUpSingleUncompressedStrip might have altered and resized the
since the td_stripbytecount and td_stripoffset arrays to the new value
after the initial affectation of td_nstrips = TIFFNumberOfStrips() in
tif_dirread.c ~line 3612.
See http://bugzilla.maptools.org/show_bug.cgi?id=2587 */
if( td->td_nstrips )
return td->td_nstrips;

nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

0 comments on commit d651abc

Please sign in to comment.
You can’t perform that action at this time.