← Back to branch summary

~ubuntu-branches/ubuntu/vivid/tiff/vivid-proposed

« back to all changes in this revision

Viewing changes to tools/tiffdump.c

  • Committer: Package Import Robot
  • Author(s): Moritz Muehlenhoff
  • Date: 2015-02-21 13:06:08 UTC
  • Revision ID: package-import@ubuntu.com-20150221130608-wchjs7u2376opwgf
Tags: 4.0.3-12.1
* NMU as discussed with Ondrej, the future adopter of tiff
* Fix multiple security issues, exact details will be recorded in the
  Debian security tracker

Show diffs side-by-side

added added

removed removed

Lines of Context:
tools/tiffdump.c
355
355
                void* datamem;
356
356
                uint64 dataoffset;
357
357
                int datatruncated;
 
358
        int datasizeoverflow;
 
359
 
358
360
                tag = *(uint16*)dp;
359
361
                if (swabflag)
360
362
                        TIFFSwabShort(&tag);
393
395
                else
394
396
                        typewidth = datawidth[type];
395
397
                datasize = count*typewidth;
 
398
        datasizeoverflow = (typewidth > 0 && datasize / typewidth != count);
396
399
                datafits = 1;
397
400
                datamem = dp;
398
401
                dataoffset = 0;
399
402
                datatruncated = 0;
400
403
                if (!bigtiff)
401
404
                {
402
 
                        if (datasize>4)
 
405
                        if (datasizeoverflow || datasize>4)
403
406
                        {
404
407
                                uint32 dataoffset32;
405
408
                                datafits = 0;
413
416
                }
414
417
                else
415
418
                {
416
 
                        if (datasize>8)
 
419
                        if (datasizeoverflow || datasize>8)
417
420
                        {
418
421
                                datafits = 0;
419
422
                                datamem = NULL;
423
426
                        }
424
427
                        dp += sizeof(uint64);
425
428
                }
426
 
                if (datasize>0x10000)
 
429
                if (datasizeoverflow || datasize>0x10000)
427
430
                {
428
431
                        datatruncated = 1;
429
432
                        count = 0x10000/typewidth;