|
 |
ccba1e |
From 8e3772f232bf8f8c1959f229b5d922dd33a1e558 Mon Sep 17 00:00:00 2001
|
|
|
ccba1e |
From: Brian May <brian@linuxpenguins.xyz>
|
|
|
ccba1e |
Date: Thu, 7 Dec 2017 07:49:20 +1100
|
|
|
ccba1e |
Subject: [PATCH] (CVE-2017-9935) tiff2pdf: Fix apparent incorrect type for
|
|
|
ccba1e |
transfer table
|
|
|
ccba1e |
|
|
|
ccba1e |
The standard says the transfer table contains unsigned 16 bit values,
|
|
|
ccba1e |
I have no idea why we refer to them as floats.
|
|
|
ccba1e |
|
|
|
ccba1e |
(cherry picked from commit d4f213636b6f950498a1386083199bd7f65676b9)
|
|
|
ccba1e |
---
|
|
|
ccba1e |
tools/tiff2pdf.c | 12 ++++++------
|
|
|
ccba1e |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
ccba1e |
|
|
|
ccba1e |
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
|
|
|
ccba1e |
index ef5d6a01..bd23c9e5 100644
|
|
|
ccba1e |
--- a/tools/tiff2pdf.c
|
|
|
ccba1e |
+++ b/tools/tiff2pdf.c
|
|
|
ccba1e |
@@ -239,7 +239,7 @@ typedef struct {
|
|
|
ccba1e |
float tiff_whitechromaticities[2];
|
|
|
ccba1e |
float tiff_primarychromaticities[6];
|
|
|
ccba1e |
float tiff_referenceblackwhite[2];
|
|
|
ccba1e |
- float* tiff_transferfunction[3];
|
|
|
ccba1e |
+ uint16* tiff_transferfunction[3];
|
|
|
ccba1e |
int pdf_image_interpolate; /* 0 (default) : do not interpolate,
|
|
|
ccba1e |
1 : interpolate */
|
|
|
ccba1e |
uint16 tiff_transferfunctioncount;
|
|
|
ccba1e |
@@ -1050,7 +1050,7 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
|
|
|
ccba1e |
uint16 paged=0;
|
|
|
ccba1e |
uint16 xuint16=0;
|
|
|
ccba1e |
uint16 tiff_transferfunctioncount=0;
|
|
|
ccba1e |
- float* tiff_transferfunction[3];
|
|
|
ccba1e |
+ uint16* tiff_transferfunction[3];
|
|
|
ccba1e |
|
|
|
ccba1e |
directorycount=TIFFNumberOfDirectories(input);
|
|
|
ccba1e |
if(directorycount > TIFF_DIR_MAX) {
|
|
|
ccba1e |
@@ -1163,8 +1163,8 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
|
|
|
ccba1e |
&(tiff_transferfunction[1]),
|
|
|
ccba1e |
&(tiff_transferfunction[2]))) {
|
|
|
ccba1e |
|
|
|
ccba1e |
- if((tiff_transferfunction[1] != (float*) NULL) &&
|
|
|
ccba1e |
- (tiff_transferfunction[2] != (float*) NULL)
|
|
|
ccba1e |
+ if((tiff_transferfunction[1] != (uint16*) NULL) &&
|
|
|
ccba1e |
+ (tiff_transferfunction[2] != (uint16*) NULL)
|
|
|
ccba1e |
) {
|
|
|
ccba1e |
tiff_transferfunctioncount=3;
|
|
|
ccba1e |
} else {
|
|
|
ccba1e |
@@ -1861,8 +1861,8 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
|
|
|
ccba1e |
&(t2p->tiff_transferfunction[0]),
|
|
|
ccba1e |
&(t2p->tiff_transferfunction[1]),
|
|
|
ccba1e |
&(t2p->tiff_transferfunction[2]))) {
|
|
|
ccba1e |
- if((t2p->tiff_transferfunction[1] != (float*) NULL) &&
|
|
|
ccba1e |
- (t2p->tiff_transferfunction[2] != (float*) NULL)
|
|
|
ccba1e |
+ if((t2p->tiff_transferfunction[1] != (uint16*) NULL) &&
|
|
|
ccba1e |
+ (t2p->tiff_transferfunction[2] != (uint16*) NULL)
|
|
|
ccba1e |
) {
|
|
|
ccba1e |
t2p->tiff_transferfunctioncount=3;
|
|
|
ccba1e |
} else {
|