← Back to branch summary

~ubuntu-branches/ubuntu/precise/tiff/precise-security

« back to all changes in this revision

Viewing changes to tools/tiffcrop.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-30 08:11:18 UTC
  • Revision ID: package-import@ubuntu.com-20150330081118-bvaoaii1act27voq
Tags: 3.9.5-2ubuntu1.7
* SECURITY UPDATE: Fix multiple security issues
  - debian/patches/CVE-2014-81xx-1.patch to CVE-2014-81xx-11.patch
  - debian/patches/CVE-2014-8128-5.patch
  - debian/patches/CVE-2014-9655-1.patch to CVE-2014-9655-3.patch
  - debian/patches/read_overrun.patch
  - debian/patches/CVE-2014-8130.patch
  - CVE-2014-8127 (partially)
  - CVE-2014-8128
  - CVE-2014-8129
  - CVE-2014-8130
  - CVE-2014-9330
  - CVE-2014-9655

Show diffs side-by-side

added added

removed removed

Lines of Context:
tools/tiffcrop.c
1205
1205
  tsize_t tilesize = TIFFTileSize(out);
1206
1206
  unsigned char *tilebuf = NULL;
1207
1207
 
1208
 
  TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
1209
 
  TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
1210
 
  TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
 
1208
  if( !TIFFGetField(out, TIFFTAG_TILELENGTH, &tl) ||
 
1209
      !TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw) ||
 
1210
      !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
 
1211
      return 1;
1211
1212
 
1212
1213
  tile_buffsize = tilesize;
1213
1214
  if (tilesize < (tsize_t)(tl * tile_rowsize))
5995
5996
    }
5996
5997
 
5997
5998
  read_buff = *read_ptr;
 
5999
  /* +3 : add a few guard bytes since reverseSamples16bits() can read a bit */
 
6000
  /* outside buffer */
5998
6001
  if (!read_buff)
5999
 
    read_buff = (unsigned char *)_TIFFmalloc(buffsize);
 
6002
    read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);
6000
6003
  else
6001
6004
    {
6002
6005
    if (prev_readsize < buffsize)
6005
6008
      if (!new_buff)
6006
6009
        {
6007
6010
        free (read_buff);
6008
 
        read_buff = (unsigned char *)_TIFFmalloc(buffsize);
 
6011
        read_buff = (unsigned char *)_TIFFmalloc(buffsize+3);
6009
6012
        }
6010
6013
      else
6011
6014
        read_buff = new_buff;
6012
6015
      }
6013
6016
    }
 
6017
  read_buff[buffsize] = 0;
 
6018
  read_buff[buffsize+1] = 0;
 
6019
  read_buff[buffsize+2] = 0;
6014
6020
 
6015
6021
  if (!read_buff)
6016
6022
    {