← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/tiff/oneiric-updates

« back to all changes in this revision

Viewing changes to libtiff/tif_fax3.c

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2010-06-14 13:19:59 UTC
  • Revision ID: james.westby@ubuntu.com-20100614131959-op2496hcyylejsxt
Tags: 3.9.2-3ubuntu1
* SECURITY UPDATE: arbitrary code execution via multiple integer
  overflows.  Backported upstream fixes:
  - debian/patches/CVE-2010-1411.patch
  - debian/patches/CVE-2010-2065.patch
  - debian/patches/CVE-2010-2067.patch
  - debian/patches/fix-64bit-flip.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
libtiff/tif_fax3.c
493
493
            td->td_compression == COMPRESSION_CCITTFAX4
494
494
        );
495
495
 
496
 
        nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels;
 
496
        if (needsRefLine) {
 
497
                /* integer overflow check */
 
498
                if ((uint32)rowpixels > 0xffffffff - 32 || TIFFroundup(rowpixels,32) > 0xffffffff / 2)
 
499
                        return (0);
 
500
                nruns = 2*TIFFroundup(rowpixels,32);
 
501
        } else
 
502
                nruns = rowpixels;
 
503
        /* integer overflow check */
 
504
        if (nruns > (0xffffffff - 3) / 2)
 
505
                return (0);
497
506
        nruns += 3;
498
507
        dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),
499
508
                                          "for Group 3/4 run arrays");