diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c index 8bf3ea7..f812fa2 100644 --- a/libtiff/tif_dir.c +++ b/libtiff/tif_dir.c @@ -160,6 +160,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap) TIFFDirectory* td = &tif->tif_dir; int status = 1; uint32 v32, i, v; + double dblval; char* s; const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY); uint32 standard_tag = tag; @@ -283,10 +284,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap) setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel); break; case TIFFTAG_XRESOLUTION: - td->td_xresolution = (float) va_arg(ap, double); + dblval = va_arg(ap, double); + if( dblval < 0 ) + goto badvaluedouble; + td->td_xresolution = (float) dblval; break; case TIFFTAG_YRESOLUTION: - td->td_yresolution = (float) va_arg(ap, double); + dblval = va_arg(ap, double); + if( dblval < 0 ) + goto badvaluedouble; + td->td_yresolution = (float) dblval; break; case TIFFTAG_PLANARCONFIG: v = (uint16) va_arg(ap, uint16_vap); @@ -693,6 +700,16 @@ badvalue32: va_end(ap); } return (0); +badvaluedouble: + { + const TIFFField* fip=TIFFFieldWithTag(tif,tag); + TIFFErrorExt(tif->tif_clientdata, module, + "%s: Bad value %f for \"%s\" tag", + tif->tif_name, dblval, + fip->field_name); + va_end(ap); + } + return (0); } /* diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c index 524e127..81084ff 100644 --- a/libtiff/tif_next.c +++ b/libtiff/tif_next.c @@ -102,6 +102,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) default: { uint32 npixels = 0, grey; uint32 imagewidth = tif->tif_dir.td_imagewidth; + if( isTiled(tif) ) + imagewidth = tif->tif_dir.td_tilewidth; /* * The scanline is composed of a sequence of constant @@ -139,10 +141,28 @@ bad: return (0); } +static int +NeXTPreDecode(TIFF* tif, uint16 s) +{ + static const char module[] = "NeXTPreDecode"; + TIFFDirectory *td = &tif->tif_dir; + (void)s; + + if( td->td_bitspersample != 2 ) + { + TIFFErrorExt(tif->tif_clientdata, module, "Unsupported BitsPerSample = %d", + td->td_bitspersample); + return (0); + } + return (1); +} + + int TIFFInitNeXT(TIFF* tif, int scheme) { (void) scheme; + tif->tif_predecode = NeXTPreDecode; tif->tif_decoderow = NeXTDecode; tif->tif_decodestrip = NeXTDecode; tif->tif_decodetile = NeXTDecode; diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c index 26a1acb..2a64ec3 100644 --- a/tools/tiff2pdf.c +++ b/tools/tiff2pdf.c @@ -1165,6 +1165,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){ if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0) && (xuint16 == PLANARCONFIG_SEPARATE ) ){ TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16); + if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 ) + { + TIFFError( + TIFF2PDF_MODULE, + "Invalid tile count, %s", + TIFFFileName(input)); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } t2p->tiff_tiles[i].tiles_tilecount/= xuint16; } if( t2p->tiff_tiles[i].tiles_tilecount > 0){ @@ -1545,6 +1554,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ #endif break; case PHOTOMETRIC_CIELAB: + if( t2p->tiff_samplesperpixel != 3){ + TIFFError( + TIFF2PDF_MODULE, + "Unsupported samplesperpixel = %d for CIELAB", + t2p->tiff_samplesperpixel); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } + if( t2p->tiff_bitspersample != 8){ + TIFFError( + TIFF2PDF_MODULE, + "Invalid bitspersample = %d for CIELAB", + t2p->tiff_bitspersample); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } t2p->pdf_labrange[0]= -127; t2p->pdf_labrange[1]= 127; t2p->pdf_labrange[2]= -127; @@ -1560,6 +1585,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){ t2p->pdf_colorspace=T2P_CS_LAB; break; case PHOTOMETRIC_ITULAB: + if( t2p->tiff_samplesperpixel != 3){ + TIFFError( + TIFF2PDF_MODULE, + "Unsupported samplesperpixel = %d for ITULAB", + t2p->tiff_samplesperpixel); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } + if( t2p->tiff_bitspersample != 8){ + TIFFError( + TIFF2PDF_MODULE, + "Invalid bitspersample = %d for ITULAB", + t2p->tiff_bitspersample); + t2p->t2p_error = T2P_ERR_ERROR; + return; + } t2p->pdf_labrange[0]=-85; t2p->pdf_labrange[1]=85; t2p->pdf_labrange[2]=-75; diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index abeb4f6..ea4f7a1 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -1205,9 +1205,10 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength, tsize_t tilesize = TIFFTileSize(out); unsigned char *tilebuf = NULL; - TIFFGetField(out, TIFFTAG_TILELENGTH, &tl); - TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw); - TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps); + if( !TIFFGetField(out, TIFFTAG_TILELENGTH, &tl) || + !TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw) || + !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) ) + return 1; tile_buffsize = tilesize; if (tilesize < (tsize_t)(tl * tile_rowsize))