|
 |
6456d8 |
Upstream patch for CVE-2011-1167, heap-based buffer overflow in thunder
|
|
|
6456d8 |
decoder (ZDI-CAN-1004).
|
|
|
6456d8 |
|
|
|
6456d8 |
|
|
|
6456d8 |
diff -Naur tiff-3.9.4.orig/libtiff/tif_thunder.c tiff-3.9.4/libtiff/tif_thunder.c
|
|
|
6456d8 |
--- tiff-3.9.4.orig/libtiff/tif_thunder.c 2010-06-08 14:50:43.000000000 -0400
|
|
|
6456d8 |
+++ tiff-3.9.4/libtiff/tif_thunder.c 2011-03-18 12:17:13.635796403 -0400
|
|
|
6456d8 |
@@ -55,12 +55,32 @@
|
|
|
6456d8 |
static const int twobitdeltas[4] = { 0, 1, 0, -1 };
|
|
|
6456d8 |
static const int threebitdeltas[8] = { 0, 1, 2, 3, 0, -3, -2, -1 };
|
|
|
6456d8 |
|
|
|
6456d8 |
-#define SETPIXEL(op, v) { \
|
|
|
6456d8 |
- lastpixel = (v) & 0xf; \
|
|
|
6456d8 |
- if (npixels++ & 1) \
|
|
|
6456d8 |
- *op++ |= lastpixel; \
|
|
|
6456d8 |
- else \
|
|
|
6456d8 |
+#define SETPIXEL(op, v) { \
|
|
|
6456d8 |
+ lastpixel = (v) & 0xf; \
|
|
|
6456d8 |
+ if ( npixels < maxpixels ) \
|
|
|
6456d8 |
+ { \
|
|
|
6456d8 |
+ if (npixels++ & 1) \
|
|
|
6456d8 |
+ *op++ |= lastpixel; \
|
|
|
6456d8 |
+ else \
|
|
|
6456d8 |
op[0] = (tidataval_t) (lastpixel << 4); \
|
|
|
6456d8 |
+ } \
|
|
|
6456d8 |
+}
|
|
|
6456d8 |
+
|
|
|
6456d8 |
+static int
|
|
|
6456d8 |
+ThunderSetupDecode(TIFF* tif)
|
|
|
6456d8 |
+{
|
|
|
6456d8 |
+ static const char module[] = "ThunderSetupDecode";
|
|
|
6456d8 |
+
|
|
|
6456d8 |
+ if( tif->tif_dir.td_bitspersample != 4 )
|
|
|
6456d8 |
+ {
|
|
|
6456d8 |
+ TIFFErrorExt(tif->tif_clientdata, module,
|
|
|
6456d8 |
+ "Wrong bitspersample value (%d), Thunder decoder only supports 4bits per sample.",
|
|
|
6456d8 |
+ (int) tif->tif_dir.td_bitspersample );
|
|
|
6456d8 |
+ return 0;
|
|
|
6456d8 |
+ }
|
|
|
6456d8 |
+
|
|
|
6456d8 |
+
|
|
|
6456d8 |
+ return (1);
|
|
|
6456d8 |
}
|
|
|
6456d8 |
|
|
|
6456d8 |
static int
|
|
|
6456d8 |
@@ -151,6 +171,7 @@
|
|
|
6456d8 |
(void) scheme;
|
|
|
6456d8 |
tif->tif_decoderow = ThunderDecodeRow;
|
|
|
6456d8 |
tif->tif_decodestrip = ThunderDecodeRow;
|
|
|
6456d8 |
+ tif->tif_setupdecode = ThunderSetupDecode;
|
|
|
6456d8 |
return (1);
|
|
|
6456d8 |
}
|
|
|
6456d8 |
#endif /* THUNDER_SUPPORT */
|