← Back to branch summary

~ubuntu-branches/ubuntu/precise/tiff/precise-security

« back to all changes in this revision

Viewing changes to libtiff/tif_read.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-30 08:11:18 UTC
  • Revision ID: package-import@ubuntu.com-20150330081118-bvaoaii1act27voq
Tags: 3.9.5-2ubuntu1.7
* SECURITY UPDATE: Fix multiple security issues
  - debian/patches/CVE-2014-81xx-1.patch to CVE-2014-81xx-11.patch
  - debian/patches/CVE-2014-8128-5.patch
  - debian/patches/CVE-2014-9655-1.patch to CVE-2014-9655-3.patch
  - debian/patches/read_overrun.patch
  - debian/patches/CVE-2014-8130.patch
  - CVE-2014-8127 (partially)
  - CVE-2014-8128
  - CVE-2014-8129
  - CVE-2014-8130
  - CVE-2014-9330
  - CVE-2014-9655

Show diffs side-by-side

added added

removed removed

Lines of Context:
libtiff/tif_read.c
243
243
                return ((tsize_t) -1);
244
244
        }
245
245
        bytecount = td->td_stripbytecount[strip];
246
 
        if (bytecount <= 0) {
 
246
        if ((int64)bytecount <= 0) {
247
247
                TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
248
248
                    "%lu: Invalid strip byte count, strip %lu",
249
249
                    (unsigned long) bytecount, (unsigned long) strip);
273
273
                 * So we are using uint32 instead of tsize_t here.
274
274
                 */
275
275
                uint32 bytecount = td->td_stripbytecount[strip];
276
 
                if (bytecount <= 0) {
 
276
                if ((int64)bytecount <= 0) {
277
277
                        TIFFErrorExt(tif->tif_clientdata, module,
278
278
                            "%s: Invalid strip byte count %lu, strip %lu",
279
279
                            tif->tif_name, (unsigned long) bytecount,
508
508
                 * So we are using uint32 instead of tsize_t here.
509
509
                 */
510
510
                uint32 bytecount = td->td_stripbytecount[tile];
511
 
                if (bytecount <= 0) {
 
511
                if ((int64)bytecount <= 0) {
512
512
                        TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
513
513
                            "%lu: Invalid tile byte count, tile %lu",
514
514
                            (unsigned long) bytecount, (unsigned long) tile);