← Back to branch summary

~ubuntu-branches/ubuntu/maverick/tiff/maverick-security

« back to all changes in this revision

Viewing changes to libtiff/tif_read.c

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2010-06-14 13:19:59 UTC
  • Revision ID: james.westby@ubuntu.com-20100614131959-op2496hcyylejsxt
Tags: 3.9.2-3ubuntu1
* SECURITY UPDATE: arbitrary code execution via multiple integer
  overflows.  Backported upstream fixes:
  - debian/patches/CVE-2010-1411.patch
  - debian/patches/CVE-2010-2065.patch
  - debian/patches/CVE-2010-2067.patch
  - debian/patches/fix-64bit-flip.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
libtiff/tif_read.c
609
609
                tif->tif_rawdata = (tidata_t) _TIFFmalloc(tif->tif_rawdatasize);
610
610
                tif->tif_flags |= TIFF_MYBUFFER;
611
611
        }
612
 
        if (tif->tif_rawdata == NULL) {
 
612
        if ((tif->tif_rawdata == NULL) || (tif->tif_rawdatasize == 0)) {
613
613
                TIFFErrorExt(tif->tif_clientdata, module,
614
614
                    "%s: No space for data buffer at scanline %ld",
615
615
                    tif->tif_name, (long) tif->tif_row);