Blame SOURCES/libtiff-CVE-2016-3991.patch

1ad933
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
1ad933
index ea4f7a1..f04e2eb 100644
1ad933
--- a/tools/tiffcrop.c
1ad933
+++ b/tools/tiffcrop.c
1ad933
@@ -798,6 +798,11 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
1ad933
     }
1ad933
 
1ad933
   tile_buffsize = tilesize;
1ad933
+  if (tilesize == 0 || tile_rowsize == 0)
1ad933
+  {
1ad933
+     TIFFError("readContigTilesIntoBuffer", "Tile size or tile rowsize is zero");
1ad933
+     exit(-1);
1ad933
+  }
1ad933
 
1ad933
   if (tilesize < (tsize_t)(tl * tile_rowsize))
1ad933
     {
1ad933
@@ -807,7 +812,12 @@ static int readContigTilesIntoBuffer (TIFF* in, uint8* buf,
1ad933
               tilesize, tl * tile_rowsize);
1ad933
 #endif
1ad933
     tile_buffsize = tl * tile_rowsize;
1ad933
-    } 
1ad933
+    if (tl != (tile_buffsize / tile_rowsize))
1ad933
+    {
1ad933
+    	TIFFError("readContigTilesIntoBuffer", "Integer overflow when calculating buffer size.");
1ad933
+        exit(-1);
1ad933
+    }
1ad933
+    }
1ad933
 
1ad933
   tilebuf = _TIFFmalloc(tile_buffsize);
1ad933
   if (tilebuf == 0)
1ad933
@@ -1210,6 +1220,12 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
1ad933
       !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
1ad933
       return 1;
1ad933
 
1ad933
+  if (tilesize == 0 || tile_rowsize == 0 || tl == 0 || tw == 0)
1ad933
+  {
1ad933
+    TIFFError("writeBufferToContigTiles", "Tile size, tile row size, tile width, or tile length is zero");
1ad933
+    exit(-1);
1ad933
+  }
1ad933
+  
1ad933
   tile_buffsize = tilesize;
1ad933
   if (tilesize < (tsize_t)(tl * tile_rowsize))
1ad933
     {
1ad933
@@ -1219,6 +1235,11 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
1ad933
               tilesize, tl * tile_rowsize);
1ad933
 #endif
1ad933
     tile_buffsize = tl * tile_rowsize;
1ad933
+    if (tl != tile_buffsize / tile_rowsize)
1ad933
+    {
1ad933
+	TIFFError("writeBufferToContigTiles", "Integer overflow when calculating buffer size");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
     }
1ad933
 
1ad933
   tilebuf = _TIFFmalloc(tile_buffsize);
1ad933
@@ -5931,12 +5952,27 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
1ad933
     TIFFGetField(in, TIFFTAG_TILELENGTH, &tl;;
1ad933
 
1ad933
     tile_rowsize  = TIFFTileRowSize(in);      
1ad933
+    if (ntiles == 0 || tlsize == 0 || tile_rowsize == 0)
1ad933
+    {
1ad933
+	TIFFError("loadImage", "File appears to be tiled, but the number of tiles, tile size, or tile rowsize is zero.");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
     buffsize = tlsize * ntiles;
1ad933
+    if (tlsize != (buffsize / ntiles))
1ad933
+    {
1ad933
+	TIFFError("loadImage", "Integer overflow when calculating buffer size");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
 
1ad933
-        
1ad933
     if (buffsize < (uint32)(ntiles * tl * tile_rowsize))
1ad933
       {
1ad933
       buffsize = ntiles * tl * tile_rowsize;
1ad933
+      if (ntiles != (buffsize / tl / tile_rowsize))
1ad933
+      {
1ad933
+	TIFFError("loadImage", "Integer overflow when calculating buffer size");
1ad933
+	exit(-1);
1ad933
+      }
1ad933
+      
1ad933
 #ifdef DEBUG2
1ad933
       TIFFError("loadImage",
1ad933
 	        "Tilesize %u is too small, using ntiles * tilelength * tilerowsize %lu",
1ad933
@@ -5955,8 +5991,25 @@ loadImage(TIFF* in, struct image_data *image, struct dump_opts *dump, unsigned c
1ad933
     TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
1ad933
     stsize = TIFFStripSize(in);
1ad933
     nstrips = TIFFNumberOfStrips(in);
1ad933
+    if (nstrips == 0 || stsize == 0)
1ad933
+    {
1ad933
+	TIFFError("loadImage", "File appears to be striped, but the number of stipes or stripe size is zero.");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
+
1ad933
     buffsize = stsize * nstrips;
1ad933
-    
1ad933
+    if (stsize != (buffsize / nstrips))
1ad933
+    {
1ad933
+	TIFFError("loadImage", "Integer overflow when calculating buffer size");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
+    uint32 buffsize_check;
1ad933
+    buffsize_check = ((length * width * spp * bps) + 7);
1ad933
+    if (length != ((buffsize_check - 7) / width / spp / bps))
1ad933
+    {
1ad933
+	TIFFError("loadImage", "Integer overflow detected.");
1ad933
+	exit(-1);
1ad933
+    }
1ad933
     if (buffsize < (uint32) (((length * width * spp * bps) + 7) / 8))
1ad933
       {
1ad933
       buffsize =  ((length * width * spp * bps) + 7) / 8;