|
 |
7c98bb |
Upstream patch for CVE-2011-1167, heap-based buffer overflow in thunder
|
|
|
7c98bb |
decoder (ZDI-CAN-1004).
|
|
|
7c98bb |
|
|
|
7c98bb |
|
|
|
7c98bb |
diff -Naur tiff-3.9.4.orig/libtiff/tif_thunder.c tiff-3.9.4/libtiff/tif_thunder.c
|
|
|
7c98bb |
--- tiff-3.9.4.orig/libtiff/tif_thunder.c 2010-06-08 14:50:43.000000000 -0400
|
|
|
7c98bb |
+++ tiff-3.9.4/libtiff/tif_thunder.c 2011-03-18 12:17:13.635796403 -0400
|
|
|
7c98bb |
@@ -55,12 +55,32 @@
|
|
|
7c98bb |
static const int twobitdeltas[4] = { 0, 1, 0, -1 };
|
|
|
7c98bb |
static const int threebitdeltas[8] = { 0, 1, 2, 3, 0, -3, -2, -1 };
|
|
|
7c98bb |
|
|
|
7c98bb |
-#define SETPIXEL(op, v) { \
|
|
|
7c98bb |
- lastpixel = (v) & 0xf; \
|
|
|
7c98bb |
- if (npixels++ & 1) \
|
|
|
7c98bb |
- *op++ |= lastpixel; \
|
|
|
7c98bb |
- else \
|
|
|
7c98bb |
+#define SETPIXEL(op, v) { \
|
|
|
7c98bb |
+ lastpixel = (v) & 0xf; \
|
|
|
7c98bb |
+ if ( npixels < maxpixels ) \
|
|
|
7c98bb |
+ { \
|
|
|
7c98bb |
+ if (npixels++ & 1) \
|
|
|
7c98bb |
+ *op++ |= lastpixel; \
|
|
|
7c98bb |
+ else \
|
|
|
7c98bb |
op[0] = (tidataval_t) (lastpixel << 4); \
|
|
|
7c98bb |
+ } \
|
|
|
7c98bb |
+}
|
|
|
7c98bb |
+
|
|
|
7c98bb |
+static int
|
|
|
7c98bb |
+ThunderSetupDecode(TIFF* tif)
|
|
|
7c98bb |
+{
|
|
|
7c98bb |
+ static const char module[] = "ThunderSetupDecode";
|
|
|
7c98bb |
+
|
|
|
7c98bb |
+ if( tif->tif_dir.td_bitspersample != 4 )
|
|
|
7c98bb |
+ {
|
|
|
7c98bb |
+ TIFFErrorExt(tif->tif_clientdata, module,
|
|
|
7c98bb |
+ "Wrong bitspersample value (%d), Thunder decoder only supports 4bits per sample.",
|
|
|
7c98bb |
+ (int) tif->tif_dir.td_bitspersample );
|
|
|
7c98bb |
+ return 0;
|
|
|
7c98bb |
+ }
|
|
|
7c98bb |
+
|
|
|
7c98bb |
+
|
|
|
7c98bb |
+ return (1);
|
|
|
7c98bb |
}
|
|
|
7c98bb |
|
|
|
7c98bb |
static int
|
|
|
7c98bb |
@@ -151,6 +171,7 @@
|
|
|
7c98bb |
(void) scheme;
|
|
|
7c98bb |
tif->tif_decoderow = ThunderDecodeRow;
|
|
|
7c98bb |
tif->tif_decodestrip = ThunderDecodeRow;
|
|
|
7c98bb |
+ tif->tif_setupdecode = ThunderSetupDecode;
|
|
|
7c98bb |
return (1);
|
|
|
7c98bb |
}
|
|
|
7c98bb |
#endif /* THUNDER_SUPPORT */
|