From aa6829cda019f56ed882b2db2d1e84c994412f9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= Date: Wed, 11 Jan 2017 12:58:22 +0100 Subject: [PATCH 3/5] Fix CVE-2016-9540 --- tools/tiffcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/tiffcp.c b/tools/tiffcp.c index 8c696db..2903461 100644 --- a/tools/tiffcp.c +++ b/tools/tiffcp.c @@ -1330,7 +1330,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer) uint32 colb = 0; uint32 col; - for (col = 0; col < imagewidth; col += tw) { + for (col = 0; col < imagewidth && colb < imagew; col += tw) { if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0 && !ignore) { TIFFError(TIFFFileName(in), @@ -1515,7 +1515,7 @@ DECLAREwriteFunc(writeBufferToContigTiles) uint32 colb = 0; uint32 col; - for (col = 0; col < imagewidth; col += tw) { + for (col = 0; col < imagewidth && colb < imagew; col += tw) { /* * Tile is clipped horizontally. Calculate * visible portion and skewing factors. -- 2.7.4