Blame SOURCES/libtiff-tiffdump.patch
|
 |
7c98bb |
Make tiffdump more paranoid about checking the count field of a directory
|
|
|
7c98bb |
entry.
|
|
|
7c98bb |
|
|
|
7c98bb |
Filed upstream at http://bugzilla.maptools.org/show_bug.cgi?id=2218
|
|
|
7c98bb |
|
|
|
7c98bb |
|
|
|
7c98bb |
diff -Naur tiff-3.9.4.orig/tools/tiffdump.c tiff-3.9.4/tools/tiffdump.c
|
|
|
7c98bb |
--- tiff-3.9.4.orig/tools/tiffdump.c 2010-06-08 14:50:44.000000000 -0400
|
|
|
7c98bb |
+++ tiff-3.9.4/tools/tiffdump.c 2010-06-22 12:51:42.207932477 -0400
|
|
|
7c98bb |
@@ -46,6 +46,7 @@
|
|
|
7c98bb |
# include <io.h>
|
|
|
7c98bb |
#endif
|
|
|
7c98bb |
|
|
|
7c98bb |
+#include "tiffiop.h"
|
|
|
7c98bb |
#include "tiffio.h"
|
|
|
7c98bb |
|
|
|
7c98bb |
#ifndef O_BINARY
|
|
|
7c98bb |
@@ -317,7 +318,7 @@
|
|
|
7c98bb |
printf(">\n");
|
|
|
7c98bb |
continue;
|
|
|
7c98bb |
}
|
|
|
7c98bb |
- space = dp->tdir_count * datawidth[dp->tdir_type];
|
|
|
7c98bb |
+ space = TIFFSafeMultiply(int, dp->tdir_count, datawidth[dp->tdir_type]);
|
|
|
7c98bb |
if (space <= 0) {
|
|
|
7c98bb |
printf(">\n");
|
|
|
7c98bb |
Error("Invalid count for tag %u", dp->tdir_tag);
|
|
|
7c98bb |
@@ -709,7 +710,7 @@
|
|
|
7c98bb |
w = (dir->tdir_type < NWIDTHS ? datawidth[dir->tdir_type] : 0);
|
|
|
7c98bb |
cc = dir->tdir_count * w;
|
|
|
7c98bb |
if (lseek(fd, (off_t)dir->tdir_offset, 0) != (off_t)-1
|
|
|
7c98bb |
- && read(fd, cp, cc) != -1) {
|
|
|
7c98bb |
+ && read(fd, cp, cc) == cc) {
|
|
|
7c98bb |
if (swabflag) {
|
|
|
7c98bb |
switch (dir->tdir_type) {
|
|
|
7c98bb |
case TIFF_SHORT:
|