Blame SOURCES/libtiff-tiffdump.patch
|
 |
0e6869 |
Make tiffdump more paranoid about checking the count field of a directory
|
|
|
0e6869 |
entry.
|
|
|
0e6869 |
|
|
|
0e6869 |
Filed upstream at http://bugzilla.maptools.org/show_bug.cgi?id=2218
|
|
|
0e6869 |
|
|
|
0e6869 |
|
|
|
0e6869 |
diff -Naur tiff-3.9.4.orig/tools/tiffdump.c tiff-3.9.4/tools/tiffdump.c
|
|
|
0e6869 |
--- tiff-3.9.4.orig/tools/tiffdump.c 2010-06-08 14:50:44.000000000 -0400
|
|
|
0e6869 |
+++ tiff-3.9.4/tools/tiffdump.c 2010-06-22 12:51:42.207932477 -0400
|
|
|
0e6869 |
@@ -46,6 +46,7 @@
|
|
|
0e6869 |
# include <io.h>
|
|
|
0e6869 |
#endif
|
|
|
0e6869 |
|
|
|
0e6869 |
+#include "tiffiop.h"
|
|
|
0e6869 |
#include "tiffio.h"
|
|
|
0e6869 |
|
|
|
0e6869 |
#ifndef O_BINARY
|
|
|
0e6869 |
@@ -317,7 +318,7 @@
|
|
|
0e6869 |
printf(">\n");
|
|
|
0e6869 |
continue;
|
|
|
0e6869 |
}
|
|
|
0e6869 |
- space = dp->tdir_count * datawidth[dp->tdir_type];
|
|
|
0e6869 |
+ space = TIFFSafeMultiply(int, dp->tdir_count, datawidth[dp->tdir_type]);
|
|
|
0e6869 |
if (space <= 0) {
|
|
|
0e6869 |
printf(">\n");
|
|
|
0e6869 |
Error("Invalid count for tag %u", dp->tdir_tag);
|
|
|
0e6869 |
@@ -709,7 +710,7 @@
|
|
|
0e6869 |
w = (dir->tdir_type < NWIDTHS ? datawidth[dir->tdir_type] : 0);
|
|
|
0e6869 |
cc = dir->tdir_count * w;
|
|
|
0e6869 |
if (lseek(fd, (off_t)dir->tdir_offset, 0) != (off_t)-1
|
|
|
0e6869 |
- && read(fd, cp, cc) != -1) {
|
|
|
0e6869 |
+ && read(fd, cp, cc) == cc) {
|
|
|
0e6869 |
if (swabflag) {
|
|
|
0e6869 |
switch (dir->tdir_type) {
|
|
|
0e6869 |
case TIFF_SHORT:
|