From 46d1b6c09939eef09e45ccec345c6724cabc454e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
Date: Mon, 11 Jul 2016 16:44:22 +0200
Subject: [PATCH 6/8] Fix CVE-2016-3990

---
 libtiff/tif_pixarlog.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/libtiff/tif_pixarlog.c b/libtiff/tif_pixarlog.c
index 2793b22..c9f056e 100644
--- a/libtiff/tif_pixarlog.c
+++ b/libtiff/tif_pixarlog.c
@@ -462,6 +462,7 @@ typedef	struct {
 	int			state;
 	int			user_datafmt;
 	int			quality;
+	tsize_t			tbuf_size;
 #define PLSTATE_INIT 1
 
 	TIFFVSetMethod		vgetparent;	/* super-class method */
@@ -885,6 +886,7 @@ PixarLogSetupEncode(TIFF* tif)
 	    td->td_samplesperpixel : 1);
 	tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth),
 				      td->td_rowsperstrip), sizeof(uint16));
+	sp->tbuf_size = tbuf_size;
 	if (tbuf_size == 0)
 		return (0);  /* TODO: this is an error return without error report through TIFFErrorExt */
 	sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size);
@@ -1131,8 +1133,17 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 	}
 
 	llen = sp->stride * td->td_imagewidth;
-
+	if (llen > sp->tbuf_size)	
+	{
+		TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Buffer limit reached.", tif->tif_name);
+		exit (0);
+	}
 	for (i = 0, up = sp->tbuf; i < n; i += llen, up += llen) {
+		if (up > sp->tbuf+sp->tbuf_size)
+		{
+			TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Buffer limit reached.", tif->tif_name);
+			exit (0);
+		}
 		switch (sp->user_datafmt)  {
 		case PIXARLOGDATAFMT_FLOAT:
 			horizontalDifferenceF((float *)bp, llen, 
@@ -1169,6 +1180,11 @@ PixarLogEncode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 			     "ZLib cannot deal with buffers this size");
 		return (0);
 	}
+	if (sp->stream.avail_in > sp->tbuf_size)
+	{
+		TIFFErrorExt(tif->tif_clientdata, module, "%s: Encoder error: Error within the calculation on ZLib buffer size.", tif->tif_name);
+		return (0);
+	}
 
 	do {
 		if (deflate(&sp->stream, Z_NO_FLUSH) != Z_OK) {
-- 
2.7.4