|
 |
12208d |
From 0bbe164e12be733a1b7e0fe9939ea3461ed7fff2 Mon Sep 17 00:00:00 2001
|
|
|
12208d |
From: 4ugustus <wangdw.augustus@qq.com>
|
|
|
12208d |
Date: Thu, 10 Mar 2022 08:48:00 +0000
|
|
|
12208d |
Subject: [PATCH] (CVE-2022-0924) fix heap buffer overflow in tiffcp (#278)
|
|
|
12208d |
|
|
|
12208d |
(cherry picked from commit 88d79a45a31c74cba98c697892fed5f7db8b963a)
|
|
|
12208d |
---
|
|
|
12208d |
tools/tiffcp.c | 17 ++++++++++++++++-
|
|
|
12208d |
1 file changed, 16 insertions(+), 1 deletion(-)
|
|
|
12208d |
|
|
|
12208d |
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
|
|
|
12208d |
index 96f14728..d5f1d248 100644
|
|
|
12208d |
--- a/tools/tiffcp.c
|
|
|
12208d |
+++ b/tools/tiffcp.c
|
|
|
12208d |
@@ -1506,12 +1506,27 @@ DECLAREwriteFunc(writeBufferToSeparateStrips)
|
|
|
12208d |
tdata_t obuf;
|
|
|
12208d |
tstrip_t strip = 0;
|
|
|
12208d |
tsample_t s;
|
|
|
12208d |
+ uint16 bps = 0, bytes_per_sample;
|
|
|
12208d |
|
|
|
12208d |
obuf = _TIFFmalloc(stripsize);
|
|
|
12208d |
if (obuf == NULL)
|
|
|
12208d |
return (0);
|
|
|
12208d |
_TIFFmemset(obuf, 0, stripsize);
|
|
|
12208d |
(void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
|
|
|
12208d |
+ (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps;;
|
|
|
12208d |
+ if( bps == 0 )
|
|
|
12208d |
+ {
|
|
|
12208d |
+ TIFFError(TIFFFileName(out), "Error, cannot read BitsPerSample");
|
|
|
12208d |
+ _TIFFfree(obuf);
|
|
|
12208d |
+ return 0;
|
|
|
12208d |
+ }
|
|
|
12208d |
+ if( (bps % 8) != 0 )
|
|
|
12208d |
+ {
|
|
|
12208d |
+ TIFFError(TIFFFileName(out), "Error, cannot handle BitsPerSample that is not a multiple of 8");
|
|
|
12208d |
+ _TIFFfree(obuf);
|
|
|
12208d |
+ return 0;
|
|
|
12208d |
+ }
|
|
|
12208d |
+ bytes_per_sample = bps/8;
|
|
|
12208d |
for (s = 0; s < spp; s++) {
|
|
|
12208d |
uint32 row;
|
|
|
12208d |
for (row = 0; row < imagelength; row += rowsperstrip) {
|
|
|
12208d |
@@ -1521,7 +1536,7 @@ DECLAREwriteFunc(writeBufferToSeparateStrips)
|
|
|
12208d |
|
|
|
12208d |
cpContigBufToSeparateBuf(
|
|
|
12208d |
obuf, (uint8*) buf + row*rowsize + s,
|
|
|
12208d |
- nrows, imagewidth, 0, 0, spp, 1);
|
|
|
12208d |
+ nrows, imagewidth, 0, 0, spp, bytes_per_sample);
|
|
|
12208d |
if (TIFFWriteEncodedStrip(out, strip++, obuf, stripsize) < 0) {
|
|
|
12208d |
TIFFError(TIFFFileName(out),
|
|
|
12208d |
"Error, can't write strip %u",
|