|
 |
6456d8 |
This patch is submitted to upstream for CVE-2012-1173
|
|
|
6456d8 |
|
|
|
6456d8 |
|
|
|
6456d8 |
diff -Naur tiff-3.9.5.orig/libtiff/tif_getimage.c tiff-3.9.5/libtiff/tif_getimage.c
|
|
|
6456d8 |
--- tiff-3.9.5.orig/libtiff/tif_getimage.c 2010-07-08 12:17:59.000000000 -0400
|
|
|
6456d8 |
+++ tiff-3.9.5/libtiff/tif_getimage.c 2012-03-14 14:49:25.796728783 -0400
|
|
|
6456d8 |
@@ -673,18 +673,24 @@
|
|
|
6456d8 |
unsigned char* p2;
|
|
|
6456d8 |
unsigned char* pa;
|
|
|
6456d8 |
tsize_t tilesize;
|
|
|
6456d8 |
+ tsize_t bufsize;
|
|
|
6456d8 |
int32 fromskew, toskew;
|
|
|
6456d8 |
int alpha = img->alpha;
|
|
|
6456d8 |
uint32 nrow;
|
|
|
6456d8 |
int ret = 1, flip;
|
|
|
6456d8 |
|
|
|
6456d8 |
tilesize = TIFFTileSize(tif);
|
|
|
6456d8 |
- buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);
|
|
|
6456d8 |
+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize);
|
|
|
6456d8 |
+ if (bufsize == 0) {
|
|
|
6456d8 |
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");
|
|
|
6456d8 |
+ return (0);
|
|
|
6456d8 |
+ }
|
|
|
6456d8 |
+ buf = (unsigned char*) _TIFFmalloc(bufsize);
|
|
|
6456d8 |
if (buf == 0) {
|
|
|
6456d8 |
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
|
|
|
6456d8 |
return (0);
|
|
|
6456d8 |
}
|
|
|
6456d8 |
- _TIFFmemset(buf, 0, (alpha?4:3)*tilesize);
|
|
|
6456d8 |
+ _TIFFmemset(buf, 0, bufsize);
|
|
|
6456d8 |
p0 = buf;
|
|
|
6456d8 |
p1 = p0 + tilesize;
|
|
|
6456d8 |
p2 = p1 + tilesize;
|
|
|
6456d8 |
@@ -880,17 +886,23 @@
|
|
|
6456d8 |
uint32 rowsperstrip, offset_row;
|
|
|
6456d8 |
uint32 imagewidth = img->width;
|
|
|
6456d8 |
tsize_t stripsize;
|
|
|
6456d8 |
+ tsize_t bufsize;
|
|
|
6456d8 |
int32 fromskew, toskew;
|
|
|
6456d8 |
int alpha = img->alpha;
|
|
|
6456d8 |
int ret = 1, flip;
|
|
|
6456d8 |
|
|
|
6456d8 |
stripsize = TIFFStripSize(tif);
|
|
|
6456d8 |
- p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
|
|
|
6456d8 |
+ bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize);
|
|
|
6456d8 |
+ if (bufsize == 0) {
|
|
|
6456d8 |
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate");
|
|
|
6456d8 |
+ return (0);
|
|
|
6456d8 |
+ }
|
|
|
6456d8 |
+ p0 = buf = (unsigned char *)_TIFFmalloc(bufsize);
|
|
|
6456d8 |
if (buf == 0) {
|
|
|
6456d8 |
TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer");
|
|
|
6456d8 |
return (0);
|
|
|
6456d8 |
}
|
|
|
6456d8 |
- _TIFFmemset(buf, 0, (alpha?4:3)*stripsize);
|
|
|
6456d8 |
+ _TIFFmemset(buf, 0, bufsize);
|
|
|
6456d8 |
p1 = p0 + stripsize;
|
|
|
6456d8 |
p2 = p1 + stripsize;
|
|
|
6456d8 |
pa = (alpha?(p2+stripsize):NULL);
|
|
|
6456d8 |
diff -Naur tiff-3.9.5.orig/libtiff/tiffiop.h tiff-3.9.5/libtiff/tiffiop.h
|
|
|
6456d8 |
--- tiff-3.9.5.orig/libtiff/tiffiop.h 2011-03-28 09:43:43.000000000 -0400
|
|
|
6456d8 |
+++ tiff-3.9.5/libtiff/tiffiop.h 2012-03-14 14:49:25.797728754 -0400
|
|
|
6456d8 |
@@ -246,7 +246,7 @@
|
|
|
6456d8 |
#define TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
|
|
|
6456d8 |
|
|
|
6456d8 |
/* Safe multiply which returns zero if there is an integer overflow */
|
|
|
6456d8 |
-#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0)
|
|
|
6456d8 |
+#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0)
|
|
|
6456d8 |
|
|
|
6456d8 |
#define TIFFmax(A,B) ((A)>(B)?(A):(B))
|
|
|
6456d8 |
#define TIFFmin(A,B) ((A)<(B)?(A):(B))
|