From f4ee7a53cc422490986225c49f92935b3ba52866 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>
Date: Thu, 13 Dec 2018 17:06:44 +0100
Subject: [PATCH] Fix Covscan defects
---
contrib/addtiffo/addtiffo.c | 3 ++-
libtiff/tif_dir.c | 2 +-
libtiff/tif_ojpeg.c | 7 ++++++-
tools/gif2tiff.c | 21 +++++++++++++++------
tools/ras2tiff.c | 22 +++++++++++++++++++++-
tools/rasterfile.h | 16 +++++++++-------
tools/tiffcrop.c | 4 ++++
7 files changed, 58 insertions(+), 17 deletions(-)
diff --git a/contrib/addtiffo/addtiffo.c b/contrib/addtiffo/addtiffo.c
index d3920e2..47f5fa8 100644
--- a/contrib/addtiffo/addtiffo.c
+++ b/contrib/addtiffo/addtiffo.c
@@ -120,7 +120,8 @@ int main( int argc, char ** argv )
while( nOverviewCount < argc - 2 && nOverviewCount < 100 )
{
anOverviews[nOverviewCount] = atoi(argv[nOverviewCount+2]);
- if( anOverviews[nOverviewCount] <= 0)
+ if( (anOverviews[nOverviewCount] <= 0) ||
+ ((anOverviews[nOverviewCount] > 1024)))
{
fprintf( stderr, "Incorrect parameters\n" );
return(1);
diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
index f812fa2..9c613da 100644
--- a/libtiff/tif_dir.c
+++ b/libtiff/tif_dir.c
@@ -706,7 +706,7 @@ badvaluedouble:
TIFFErrorExt(tif->tif_clientdata, module,
"%s: Bad value %f for \"%s\" tag",
tif->tif_name, dblval,
- fip->field_name);
+ fip ? fip->field_name : "Unknown");
va_end(ap);
}
return (0);
diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
index 6ea3c38..1d9c77c 100644
--- a/libtiff/tif_ojpeg.c
+++ b/libtiff/tif_ojpeg.c
@@ -528,6 +528,8 @@ OJPEGVSetField(TIFF* tif, uint32 tag, va_list ap)
uint32 ma;
uint64* mb;
uint32 n;
+ const TIFFField* fip;
+
switch(tag)
{
case TIFFTAG_JPEGIFOFFSET:
@@ -597,7 +599,10 @@ OJPEGVSetField(TIFF* tif, uint32 tag, va_list ap)
default:
return (*sp->vsetparent)(tif,tag,ap);
}
- TIFFSetFieldBit(tif,TIFFFieldWithTag(tif,tag)->field_bit);
+ fip = TIFFFieldWithTag(tif,tag);
+ if( fip == NULL ) /* shouldn't happen */
+ return(0);
+ TIFFSetFieldBit(tif,fip->field_bit);
tif->tif_flags|=TIFF_DIRTYDIRECT;
return(1);
}
diff --git a/tools/gif2tiff.c b/tools/gif2tiff.c
index e89ac5b..012345d 100644
--- a/tools/gif2tiff.c
+++ b/tools/gif2tiff.c
@@ -38,6 +38,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <errno.h>
#include <math.h>
#ifdef HAVE_UNISTD_H
@@ -266,13 +267,15 @@ readgifimage(char* mode)
unsigned char localmap[256][3];
int localbits;
int status;
+ size_t raster_size;
- if (fread(buf, 1, 9, infile) == 0) {
- perror(filename);
+ if (fread(buf, 1, 9, infile) != 9) {
+ fprintf(stderr, "short read from file %s (%s)\n",
+ filename, strerror(errno));
return (0);
}
- width = buf[4] + (buf[5] << 8);
- height = buf[6] + (buf[7] << 8);
+ width = (buf[4] + (buf[5] << 8)) & 0xffff; /* 16 bit */
+ height = (buf[6] + (buf[7] << 8)) & 0xffff; /* 16 bit */
local = buf[8] & 0x80;
interleaved = buf[8] & 0x40;
@@ -280,11 +283,17 @@ readgifimage(char* mode)
fprintf(stderr, "no colormap present for image\n");
return (0);
}
- if (width == 0 || height == 0) {
+ if (width == 0UL || height == 0UL || (width > 2000000000UL / height)) {
fprintf(stderr, "Invalid value of width or height\n");
return(0);
}
- if ((raster = (unsigned char*) _TIFFmalloc(width*height+EXTRAFUDGE)) == NULL) {
+ raster_size=width*height;
+ if ((raster_size/width) == height) {
+ raster_size += EXTRAFUDGE; /* Add elbow room */
+ } else {
+ raster_size=0;
+ }
+ if ((raster = (unsigned char*) _TIFFmalloc(raster_size)) == NULL) {
fprintf(stderr, "not enough memory for image\n");
return (0);
}
diff --git a/tools/ras2tiff.c b/tools/ras2tiff.c
index ec8a071..007dd8c 100644
--- a/tools/ras2tiff.c
+++ b/tools/ras2tiff.c
@@ -30,6 +30,7 @@
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
+#include <limits.h>
#ifdef HAVE_UNISTD_H
# include <unistd.h>
@@ -122,6 +123,25 @@ main(int argc, char* argv[])
fclose(in);
return (-3);
}
+ if ((h.ras_width <= 0) || (h.ras_width >= INT_MAX) ||
+ (h.ras_height <= 0) || (h.ras_height >= INT_MAX) ||
+ (h.ras_depth <= 0) || (h.ras_depth >= INT_MAX) ||
+ (h.ras_length <= 0) || (h.ras_length >= INT_MAX) ||
+ (h.ras_type < 0) ||
+ (h.ras_maptype < 0) ||
+ (h.ras_maplength < 0) || (h.ras_maplength >= INT_MAX)) {
+ fprintf(stderr, "%s: Improper image header.\n", argv[optind]);
+ fclose(in);
+ return (-2);
+ }
+ if ((h.ras_depth != 1) &&
+ (h.ras_depth != 8) &&
+ (h.ras_depth != 24)) {
+ fprintf(stderr, "%s: Improper image depth (%d).\n",
+ argv[optind], h.ras_depth);
+ fclose(in);
+ return (-2);
+ }
out = TIFFOpen(argv[optind+1], "w");
if (out == NULL)
{
@@ -153,7 +173,7 @@ main(int argc, char* argv[])
mapsize = 1<<h.ras_depth;
if (h.ras_maplength > mapsize*3) {
fprintf(stderr,
- "%s: Huh, %ld colormap entries, should be %d?\n",
+ "%s: Huh, %d colormap entries, should be %d?\n",
argv[optind], h.ras_maplength, mapsize*3);
return (-7);
}
diff --git a/tools/rasterfile.h b/tools/rasterfile.h
index 833e095..33da707 100644
--- a/tools/rasterfile.h
+++ b/tools/rasterfile.h
@@ -1,17 +1,19 @@
/* $Header: /cvs/libtiff/tools/rasterfile.h,v 1.3 2003/11/12 19:14:33 dron Exp $ */
+#include "tiff.h"
+
/*
* Description of header for files containing raster images
*/
struct rasterfile {
char ras_magic[4]; /* magic number */
- long ras_width; /* width (pixels) of image */
- long ras_height; /* height (pixels) of image */
- long ras_depth; /* depth (1, 8, or 24 bits) of pixel */
- long ras_length; /* length (bytes) of image */
- long ras_type; /* type of file; see RT_* below */
- long ras_maptype; /* type of colormap; see RMT_* below */
- long ras_maplength; /* length (bytes) of following map */
+ int32 ras_width; /* width (pixels) of image */
+ int32 ras_height; /* height (pixels) of image */
+ int32 ras_depth; /* depth (1, 8, or 24 bits) of pixel */
+ int32 ras_length; /* length (bytes) of image */
+ int32 ras_type; /* type of file; see RT_* below */
+ int32 ras_maptype; /* type of colormap; see RMT_* below */
+ int32 ras_maplength; /* length (bytes) of following map */
/* color map follows for ras_maplength bytes, followed by image */
};
#define RAS_MAGIC "\x59\xa6\x6a\x95"
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
index 0192f3f..ae6ec1a 100644
--- a/tools/tiffcrop.c
+++ b/tools/tiffcrop.c
@@ -2029,6 +2029,10 @@ void process_command_opts (int argc, char *argv[], char *mp, char *mode, uint32
{
crop_data->zones++;
opt_offset = strchr(opt_ptr, ':');
+ if (!opt_offset) {
+ TIFFError("Wrong parameter syntax for -Z", "tiffcrop -h");
+ exit(-1);
+ }
*opt_offset = '\0';
crop_data->zonelist[i].position = atoi(opt_ptr);
crop_data->zonelist[i].total = atoi(opt_offset + 1);
--
2.21.0