|
 |
460672 |
From bb2505b3d099104a296823fc3a456680417475b0 Mon Sep 17 00:00:00 2001
|
|
|
460672 |
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
|
|
|
460672 |
Date: Thu, 12 Jan 2017 11:30:40 +0100
|
|
|
460672 |
Subject: [PATCH 4/5] Fix CVE-2016-5652
|
|
|
460672 |
|
|
|
460672 |
---
|
|
|
460672 |
tools/tiff2pdf.c | 17 ++++++++++-------
|
|
|
460672 |
1 file changed, 10 insertions(+), 7 deletions(-)
|
|
|
460672 |
|
|
|
460672 |
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
|
|
|
460672 |
index fbca305..9df5b16 100644
|
|
|
460672 |
--- a/tools/tiff2pdf.c
|
|
|
460672 |
+++ b/tools/tiff2pdf.c
|
|
|
460672 |
@@ -2826,21 +2826,24 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_
|
|
|
460672 |
return(0);
|
|
|
460672 |
}
|
|
|
460672 |
if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
|
|
|
460672 |
- if (count > 0) {
|
|
|
460672 |
- _TIFFmemcpy(buffer, jpt, count);
|
|
|
460672 |
+ if (count >= 4) {
|
|
|
460672 |
+ /* Ignore EOI marker of JpegTables */
|
|
|
460672 |
+ _TIFFmemcpy(buffer, jpt, count - 2);
|
|
|
460672 |
bufferoffset += count - 2;
|
|
|
460672 |
+ /* Store last 2 bytes of the JpegTables */
|
|
|
460672 |
table_end[0] = buffer[bufferoffset-2];
|
|
|
460672 |
table_end[1] = buffer[bufferoffset-1];
|
|
|
460672 |
- }
|
|
|
460672 |
- if (count > 0) {
|
|
|
460672 |
xuint32 = bufferoffset;
|
|
|
460672 |
+ bufferoffset -= 2;
|
|
|
460672 |
bufferoffset += TIFFReadRawTile(
|
|
|
460672 |
input,
|
|
|
460672 |
tile,
|
|
|
460672 |
- (tdata_t) &(((unsigned char*)buffer)[bufferoffset-2]),
|
|
|
460672 |
+ (tdata_t) &(((unsigned char*)buffer)[bufferoffset]),
|
|
|
460672 |
-1);
|
|
|
460672 |
- buffer[xuint32-2]=table_end[0];
|
|
|
460672 |
- buffer[xuint32-1]=table_end[1];
|
|
|
460672 |
+ /* Overwrite SOI marker of image scan with previously */
|
|
|
460672 |
+ /* saved end of JpegTables */
|
|
|
460672 |
+ buffer[xuint32-2]=table_end[0];
|
|
|
460672 |
+ buffer[xuint32-1]=table_end[1];
|
|
|
460672 |
} else {
|
|
|
460672 |
bufferoffset += TIFFReadRawTile(
|
|
|
460672 |
input,
|
|
|
460672 |
--
|
|
|
460672 |
2.7.4
|
|
|
460672 |
|