← Back to branch summary

~ubuntu-branches/ubuntu/precise/tiff/precise-security

« back to all changes in this revision

Viewing changes to libtiff/tif_getimage.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-30 08:11:18 UTC
  • Revision ID: package-import@ubuntu.com-20150330081118-bvaoaii1act27voq
Tags: 3.9.5-2ubuntu1.7
* SECURITY UPDATE: Fix multiple security issues
  - debian/patches/CVE-2014-81xx-1.patch to CVE-2014-81xx-11.patch
  - debian/patches/CVE-2014-8128-5.patch
  - debian/patches/CVE-2014-9655-1.patch to CVE-2014-9655-3.patch
  - debian/patches/read_overrun.patch
  - debian/patches/CVE-2014-8130.patch
  - CVE-2014-8127 (partially)
  - CVE-2014-8128
  - CVE-2014-8129
  - CVE-2014-8130
  - CVE-2014-9330
  - CVE-2014-9655

Show diffs side-by-side

added added

removed removed

Lines of Context:
libtiff/tif_getimage.c
178
178
                                    "Planarconfiguration", td->td_planarconfig);
179
179
                                return (0);
180
180
                        }
 
181
                        if( td->td_samplesperpixel != 3 )
 
182
            {
 
183
                sprintf(emsg,
 
184
                        "Sorry, can not handle image with %s=%d",
 
185
                        "Samples/pixel", td->td_samplesperpixel);
 
186
                return 0;
 
187
            }
181
188
                        break;
182
189
                case PHOTOMETRIC_CIELAB:
 
190
            if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
 
191
            {
 
192
                sprintf(emsg,
 
193
                        "Sorry, can not handle image with %s=%d and %s=%d",
 
194
                        "Samples/pixel", td->td_samplesperpixel,
 
195
                        "Bits/sample", td->td_bitspersample);
 
196
                return 0;
 
197
            }
183
198
                        break;
184
199
                default:
185
200
                        sprintf(emsg, "Sorry, can not handle image with %s=%d",
805
820
        int32 fromskew, toskew;
806
821
        int ret = 1, flip;
807
822
 
 
823
        TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);
 
824
        if( subsamplingver == 0 ) {
 
825
                TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Invalid vertical YCbCr subsampling");
 
826
                return (0);
 
827
        }
 
828
 
808
829
        buf = (unsigned char*) _TIFFmalloc(TIFFStripSize(tif));
809
830
        if (buf == 0) {
810
831
                TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");
822
843
        }
823
844
 
824
845
        TIFFGetFieldDefaulted(tif, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
825
 
        TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);
 
846
 
826
847
        scanline = TIFFNewScanlineSize(tif);
827
848
        fromskew = (w < imagewidth ? imagewidth - w : 0);
828
849
        for (row = 0; row < h; row += nrow)
1740
1761
 
1741
1762
    (void) y;
1742
1763
    fromskew = (fromskew * 10) / 4;
1743
 
    if ((h & 3) == 0 && (w & 1) == 0) {
 
1764
    if ((w & 3) == 0 && (h & 1) == 0) {
1744
1765
        for (; h >= 2; h -= 2) {
1745
1766
            x = w>>2;
1746
1767
            do {
1817
1838
    /* XXX adjust fromskew */
1818
1839
    do {
1819
1840
        x = w>>2;
1820
 
        do {
 
1841
        while(x>0) {
1821
1842
            int32 Cb = pp[4];
1822
1843
            int32 Cr = pp[5];
1823
1844
 
1828
1849
 
1829
1850
            cp += 4;
1830
1851
            pp += 6;
1831
 
        } while (--x);
 
1852
                x--;
 
1853
        }
1832
1854
 
1833
1855
        if( (w&3) != 0 )
1834
1856
        {
1919
1941
        fromskew = (fromskew * 4) / 2;
1920
1942
        do {
1921
1943
                x = w>>1;
1922
 
                do {
 
1944
                while(x>0) {
1923
1945
                        int32 Cb = pp[2];
1924
1946
                        int32 Cr = pp[3];
1925
1947
 
1928
1950
 
1929
1951
                        cp += 2;
1930
1952
                        pp += 4;
1931
 
                } while (--x);
 
1953
                        x --;
 
1954
                }
1932
1955
 
1933
1956
                if( (w&1) != 0 )
1934
1957
                {