opt/libtiff/CVE-2012-2088.patch

163 lines
5.0 KiB
Diff

Index: libtiff/tif_strip.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_strip.c,v
retrieving revision 1.19.2.3
diff -c -r1.19.2.3 tif_strip.c
*** libtiff/tif_strip.c 15 Dec 2010 00:50:30 -0000 1.19.2.3
--- libtiff/tif_strip.c 17 Apr 2012 18:14:22 -0000
***************
*** 107,112 ****
--- 107,113 ----
TIFFVStripSize(TIFF* tif, uint32 nrows)
{
TIFFDirectory *td = &tif->tif_dir;
+ uint32 stripsize;
if (nrows == (uint32) -1)
nrows = td->td_imagelength;
***************
*** 122,128 ****
* YCbCr data for the extended image.
*/
uint16 ycbcrsubsampling[2];
! tsize_t w, scanline, samplingarea;
TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING,
ycbcrsubsampling + 0,
--- 123,129 ----
* YCbCr data for the extended image.
*/
uint16 ycbcrsubsampling[2];
! uint32 w, scanline, samplingarea;
TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING,
ycbcrsubsampling + 0,
***************
*** 141,153 ****
nrows = TIFFroundup(nrows, ycbcrsubsampling[1]);
/* NB: don't need TIFFhowmany here 'cuz everything is rounded */
scanline = multiply(tif, nrows, scanline, "TIFFVStripSize");
! return ((tsize_t)
summarize(tif, scanline,
multiply(tif, 2, scanline / samplingarea,
! "TIFFVStripSize"), "TIFFVStripSize"));
} else
! return ((tsize_t) multiply(tif, nrows, TIFFScanlineSize(tif),
! "TIFFVStripSize"));
}
--- 142,160 ----
nrows = TIFFroundup(nrows, ycbcrsubsampling[1]);
/* NB: don't need TIFFhowmany here 'cuz everything is rounded */
scanline = multiply(tif, nrows, scanline, "TIFFVStripSize");
! stripsize =
summarize(tif, scanline,
multiply(tif, 2, scanline / samplingarea,
! "TIFFVStripSize"), "TIFFVStripSize");
} else
! stripsize = multiply(tif, nrows, TIFFScanlineSize(tif),
! "TIFFVStripSize");
! /* Because tsize_t is signed, we might have conversion overflow */
! if (((tsize_t) stripsize) < 0) {
! TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVStripSize");
! stripsize = 0;
! }
! return (tsize_t) stripsize;
}
Index: libtiff/tif_tile.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_tile.c,v
retrieving revision 1.12.2.1
diff -c -r1.12.2.1 tif_tile.c
*** libtiff/tif_tile.c 8 Jun 2010 18:50:43 -0000 1.12.2.1
--- libtiff/tif_tile.c 17 Apr 2012 18:14:22 -0000
***************
*** 174,180 ****
TIFFTileRowSize(TIFF* tif)
{
TIFFDirectory *td = &tif->tif_dir;
! tsize_t rowsize;
if (td->td_tilelength == 0 || td->td_tilewidth == 0)
return ((tsize_t) 0);
--- 174,180 ----
TIFFTileRowSize(TIFF* tif)
{
TIFFDirectory *td = &tif->tif_dir;
! uint32 rowsize;
if (td->td_tilelength == 0 || td->td_tilewidth == 0)
return ((tsize_t) 0);
***************
*** 193,199 ****
TIFFVTileSize(TIFF* tif, uint32 nrows)
{
TIFFDirectory *td = &tif->tif_dir;
! tsize_t tilesize;
if (td->td_tilelength == 0 || td->td_tilewidth == 0 ||
td->td_tiledepth == 0)
--- 193,199 ----
TIFFVTileSize(TIFF* tif, uint32 nrows)
{
TIFFDirectory *td = &tif->tif_dir;
! uint32 tilesize;
if (td->td_tilelength == 0 || td->td_tilewidth == 0 ||
td->td_tiledepth == 0)
***************
*** 209,220 ****
* horizontal/vertical subsampling area include
* YCbCr data for the extended image.
*/
! tsize_t w =
TIFFroundup(td->td_tilewidth, td->td_ycbcrsubsampling[0]);
! tsize_t rowsize =
TIFFhowmany8(multiply(tif, w, td->td_bitspersample,
"TIFFVTileSize"));
! tsize_t samplingarea =
td->td_ycbcrsubsampling[0]*td->td_ycbcrsubsampling[1];
if (samplingarea == 0) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Invalid YCbCr subsampling");
--- 209,220 ----
* horizontal/vertical subsampling area include
* YCbCr data for the extended image.
*/
! uint32 w =
TIFFroundup(td->td_tilewidth, td->td_ycbcrsubsampling[0]);
! uint32 rowsize =
TIFFhowmany8(multiply(tif, w, td->td_bitspersample,
"TIFFVTileSize"));
! uint32 samplingarea =
td->td_ycbcrsubsampling[0]*td->td_ycbcrsubsampling[1];
if (samplingarea == 0) {
TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Invalid YCbCr subsampling");
***************
*** 230,237 ****
} else
tilesize = multiply(tif, nrows, TIFFTileRowSize(tif),
"TIFFVTileSize");
! return ((tsize_t)
! multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize"));
}
/*
--- 230,242 ----
} else
tilesize = multiply(tif, nrows, TIFFTileRowSize(tif),
"TIFFVTileSize");
! tilesize = multiply(tif, tilesize, td->td_tiledepth, "TIFFVTileSize");
! /* Because tsize_t is signed, we might have conversion overflow */
! if (((tsize_t) tilesize) < 0) {
! TIFFErrorExt(tif->tif_clientdata, tif->tif_name, "Integer overflow in %s", "TIFFVTileSize");
! tilesize = 0;
! }
! return (tsize_t) tilesize;
}
/*