From aa6829cda019f56ed882b2db2d1e84c994412f9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
Date: Wed, 11 Jan 2017 12:58:22 +0100
Subject: [PATCH 3/5] Fix CVE-2016-9540
---
tools/tiffcp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/tiffcp.c b/tools/tiffcp.c
index 8c696db..2903461 100644
--- a/tools/tiffcp.c
+++ b/tools/tiffcp.c
@@ -1330,7 +1330,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)
uint32 colb = 0;
uint32 col;
- for (col = 0; col < imagewidth; col += tw) {
+ for (col = 0; col < imagewidth && colb < imagew; col += tw) {
if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
&& !ignore) {
TIFFError(TIFFFileName(in),
@@ -1515,7 +1515,7 @@ DECLAREwriteFunc(writeBufferToContigTiles)
uint32 colb = 0;
uint32 col;
- for (col = 0; col < imagewidth; col += tw) {
+ for (col = 0; col < imagewidth && colb < imagew; col += tw) {
/*
* Tile is clipped horizontally. Calculate
* visible portion and skewing factors.
--
2.7.4