79 lines
2.8 KiB
Diff
79 lines
2.8 KiB
Diff
|
--- tiff-4.0.6/tools/tiff2rgba.c 2015-08-29 00:17:08.259977702 +0200
|
||
|
|
+++ tiff-4.0.6/tools/tiff2rgba.c 2016-09-01 16:05:40.451318911 +0200
|
||
|
|
@@ -147,6 +147,7 @@
|
||
|
|
uint32 row, col;
|
||
|
|
uint32 *wrk_line;
|
||
|
|
int ok = 1;
|
||
|
|
+ uint32 rastersize, wrk_linesize;
|
||
|
|
|
||
|
|
TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
|
||
|
|
TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
|
||
|
|
@@ -163,7 +164,13 @@
|
||
|
|
/*
|
||
|
|
* Allocate tile buffer
|
||
|
|
*/
|
||
|
|
- raster = (uint32*)_TIFFmalloc(tile_width * tile_height * sizeof (uint32));
|
||
|
|
+ rastersize = tile_width * tile_height * sizeof (uint32);
|
||
|
|
+ if (tile_width != (rastersize / tile_height) / sizeof( uint32))
|
||
|
|
+ {
|
||
|
|
+ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
|
||
|
|
+ exit(-1);
|
||
|
|
+ }
|
||
|
|
+ raster = (uint32*)_TIFFmalloc(rastersize);
|
||
|
|
if (raster == 0) {
|
||
|
|
TIFFError(TIFFFileName(in), "No space for raster buffer");
|
||
|
|
return (0);
|
||
|
|
@@ -173,7 +180,13 @@
|
||
|
|
* Allocate a scanline buffer for swapping during the vertical
|
||
|
|
* mirroring pass.
|
||
|
|
*/
|
||
|
|
- wrk_line = (uint32*)_TIFFmalloc(tile_width * sizeof (uint32));
|
||
|
|
+ wrk_linesize = tile_width * sizeof (uint32);
|
||
|
|
+ if (tile_width != wrk_linesize / sizeof (uint32))
|
||
|
|
+ {
|
||
|
|
+ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
|
||
|
|
+ exit(-1);
|
||
|
|
+ }
|
||
|
|
+ wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
|
||
|
|
if (!wrk_line) {
|
||
|
|
TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
|
||
|
|
ok = 0;
|
||
|
|
@@ -249,6 +262,7 @@
|
||
|
|
uint32 row;
|
||
|
|
uint32 *wrk_line;
|
||
|
|
int ok = 1;
|
||
|
|
+ uint32 rastersize, wrk_linesize;
|
||
|
|
|
||
|
|
TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
|
||
|
|
TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
|
||
|
|
@@ -263,7 +277,13 @@
|
||
|
|
/*
|
||
|
|
* Allocate strip buffer
|
||
|
|
*/
|
||
|
|
- raster = (uint32*)_TIFFmalloc(width * rowsperstrip * sizeof (uint32));
|
||
|
|
+ rastersize = width * rowsperstrip * sizeof (uint32);
|
||
|
|
+ if (width != (rastersize / rowsperstrip) / sizeof( uint32))
|
||
|
|
+ {
|
||
|
|
+ TIFFError(TIFFFileName(in), "Integer overflow when calculating raster buffer");
|
||
|
|
+ exit(-1);
|
||
|
|
+ }
|
||
|
|
+ raster = (uint32*)_TIFFmalloc(rastersize);
|
||
|
|
if (raster == 0) {
|
||
|
|
TIFFError(TIFFFileName(in), "No space for raster buffer");
|
||
|
|
return (0);
|
||
|
|
@@ -273,7 +293,13 @@
|
||
|
|
* Allocate a scanline buffer for swapping during the vertical
|
||
|
|
* mirroring pass.
|
||
|
|
*/
|
||
|
|
- wrk_line = (uint32*)_TIFFmalloc(width * sizeof (uint32));
|
||
|
|
+ wrk_linesize = width * sizeof (uint32);
|
||
|
|
+ if (width != wrk_linesize / sizeof (uint32))
|
||
|
|
+ {
|
||
|
|
+ TIFFError(TIFFFileName(in), "Integer overflow when calculating wrk_line buffer");
|
||
|
|
+ exit(-1);
|
||
|
|
+ }
|
||
|
|
+ wrk_line = (uint32*)_TIFFmalloc(wrk_linesize);
|
||
|
|
if (!wrk_line) {
|
||
|
|
TIFFError(TIFFFileName(in), "No space for raster scanline buffer");
|
||
|
|
ok = 0;
|