Petr Gajdos
75ab37b55f
* integer-overflow.patch * NULL-deref.patch - fixes CVE-2010-2067 OBS-URL: https://build.opensuse.org/package/show/graphics/tiff?expand=0&rev=21
42 lines
929 B
Diff
42 lines
929 B
Diff
diff -Naur tiff-3.9.2.orig/libtiff/tif_getimage.c tiff-3.9.2/libtiff/tif_getimage.c
|
|
--- tiff-3.9.2.orig/libtiff/tif_getimage.c 2009-08-30 12:21:46.000000000 -0400
|
|
+++ tiff-3.9.2/libtiff/tif_getimage.c 2010-06-10 15:07:28.000000000 -0400
|
|
@@ -1846,6 +1846,7 @@
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr22tile)
|
|
{
|
|
uint32* cp2;
|
|
+ int32 incr = 2*toskew+w;
|
|
(void) y;
|
|
fromskew = (fromskew / 2) * 6;
|
|
cp2 = cp+w+toskew;
|
|
@@ -1872,8 +1873,8 @@
|
|
cp2 ++ ;
|
|
pp += 6;
|
|
}
|
|
- cp += toskew*2+w;
|
|
- cp2 += toskew*2+w;
|
|
+ cp += incr;
|
|
+ cp2 += incr;
|
|
pp += fromskew;
|
|
h-=2;
|
|
}
|
|
@@ -1939,6 +1940,7 @@
|
|
DECLAREContigPutFunc(putcontig8bitYCbCr12tile)
|
|
{
|
|
uint32* cp2;
|
|
+ int32 incr = 2*toskew+w;
|
|
(void) y;
|
|
fromskew = (fromskew / 2) * 4;
|
|
cp2 = cp+w+toskew;
|
|
@@ -1953,8 +1955,8 @@
|
|
cp2 ++;
|
|
pp += 4;
|
|
} while (--x);
|
|
- cp += toskew*2+w;
|
|
- cp2 += toskew*2+w;
|
|
+ cp += incr;
|
|
+ cp2 += incr;
|
|
pp += fromskew;
|
|
h-=2;
|
|
}
|