|
 |
460672 |
diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
|
|
|
460672 |
index b014685..13c0848 100644
|
|
|
460672 |
--- a/libtiff/tif_next.c
|
|
|
460672 |
+++ b/libtiff/tif_next.c
|
|
|
460672 |
@@ -37,7 +37,7 @@
|
|
|
460672 |
case 0: op[0] = (unsigned char) ((v) << 6); break; \
|
|
|
460672 |
case 1: op[0] |= (v) << 4; break; \
|
|
|
460672 |
case 2: op[0] |= (v) << 2; break; \
|
|
|
460672 |
- case 3: *op++ |= (v); break; \
|
|
|
460672 |
+ case 3: *op++ |= (v); op_offset++; break; \
|
|
|
460672 |
} \
|
|
|
460672 |
}
|
|
|
460672 |
|
|
|
460672 |
@@ -107,6 +107,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
|
|
|
460672 |
if( isTiled(tif) )
|
|
|
460672 |
imagewidth = tif->tif_dir.td_tilewidth;
|
|
|
460672 |
|
|
|
460672 |
+ tmsize_t op_offset = 0;
|
|
|
460672 |
+
|
|
|
460672 |
/*
|
|
|
460672 |
* The scanline is composed of a sequence of constant
|
|
|
460672 |
* color ``runs''. We shift into ``run mode'' and
|
|
|
460672 |
@@ -120,10 +122,15 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
|
|
|
460672 |
* bounds, potentially resulting in a security
|
|
|
460672 |
* issue.
|
|
|
460672 |
*/
|
|
|
460672 |
- while (n-- > 0 && npixels < imagewidth)
|
|
|
460672 |
+ while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
|
|
|
460672 |
SETPIXEL(op, grey);
|
|
|
460672 |
if (npixels >= imagewidth)
|
|
|
460672 |
break;
|
|
|
460672 |
+ if (op_offset >= scanline ) {
|
|
|
460672 |
+ TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
|
|
|
460672 |
+ (long) tif->tif_row);
|
|
|
460672 |
+ return (0);
|
|
|
460672 |
+ }
|
|
|
460672 |
if (cc == 0)
|
|
|
460672 |
goto bad;
|
|
|
460672 |
n = *bp++, cc--;
|
|
|
460672 |
@@ -162,9 +169,9 @@ NeXTPreDecode(TIFF* tif, uint16 s)
|
|
|
460672 |
TIFFInitNeXT(TIFF* tif, int scheme)
|
|
|
460672 |
{
|
|
|
460672 |
(void) scheme;
|
|
|
460672 |
- tif->tif_predecode = NeXTPreDecode;
|
|
|
460672 |
- tif->tif_decoderow = NeXTDecode;
|
|
|
460672 |
- tif->tif_decodestrip = NeXTDecode;
|
|
|
460672 |
+ tif->tif_predecode = NeXTPreDecode;
|
|
|
460672 |
+ tif->tif_decoderow = NeXTDecode;
|
|
|
460672 |
+ tif->tif_decodestrip = NeXTDecode;
|
|
|
460672 |
tif->tif_decodetile = NeXTDecode;
|
|
|
460672 |
return (1);
|
|
|
460672 |
}
|