Blame SOURCES/libtiff-CVE-2020-35524.patch

837307
From f74e26a36dd32050774f1c4a9256147fb25ae595 Mon Sep 17 00:00:00 2001
837307
From: Thomas Bernard <miniupnp@free.fr>
837307
Date: Sat, 14 Nov 2020 12:53:01 +0000
837307
Subject: [PATCH 3/3] tiff2pdf.c: properly calculate datasize when saving to
837307
 JPEG YCbCr
837307
837307
fixes #220
837307
---
837307
 tools/tiff2pdf.c | 14 +++++++++++---
837307
 1 file changed, 11 insertions(+), 3 deletions(-)
837307
837307
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
837307
index a15a3ef..db380ec 100644
837307
--- a/tools/tiff2pdf.c
837307
+++ b/tools/tiff2pdf.c
837307
@@ -2049,9 +2049,17 @@ void t2p_read_tiff_size(T2P* t2p, TIFF* input){
837307
 #endif
837307
 		(void) 0;
837307
 	}
837307
-	k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
837307
-	if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
837307
-		k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
837307
+#ifdef JPEG_SUPPORT
837307
+	if(t2p->pdf_compression == T2P_COMPRESS_JPEG
837307
+	   && t2p->tiff_photometric == PHOTOMETRIC_YCBCR) {
837307
+		k = checkMultiply64(TIFFNumberOfStrips(input), TIFFStripSize(input), t2p);
837307
+	} else
837307
+#endif
837307
+	{
837307
+		k = checkMultiply64(TIFFScanlineSize(input), t2p->tiff_length, t2p);
837307
+		if(t2p->tiff_planar==PLANARCONFIG_SEPARATE){
837307
+			k = checkMultiply64(k, t2p->tiff_samplesperpixel, t2p);
837307
+		}
837307
 	}
837307
 	if (k == 0) {
837307
 		/* Assume we had overflow inside TIFFScanlineSize */
837307
-- 
837307
2.31.1
837307