338f91dbdc
- security update
* CVE-2018-8905 [bsc#1086408]
+ tiff-CVE-2018-8905.patch
OBS-URL: https://build.opensuse.org/request/show/614252
OBS-URL: https://build.opensuse.org/package/show/graphics/tiff?expand=0&rev=121
39 lines
945 B
Diff
39 lines
945 B
Diff
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
|
|
index 4ccb443..94d85e3 100644
|
|
--- a/libtiff/tif_lzw.c
|
|
+++ b/libtiff/tif_lzw.c
|
|
@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
|
char *tp;
|
|
unsigned char *bp;
|
|
int code, nbits;
|
|
+ int len;
|
|
long nextbits, nextdata, nbitsmask;
|
|
code_t *codep, *free_entp, *maxcodep, *oldcodep;
|
|
|
|
@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
|
|
} while (--occ);
|
|
break;
|
|
}
|
|
- assert(occ >= codep->length);
|
|
- op += codep->length;
|
|
- occ -= codep->length;
|
|
- tp = op;
|
|
+ len = codep->length;
|
|
+ tp = op + len;
|
|
do {
|
|
- *--tp = codep->value;
|
|
- } while( (codep = codep->next) != NULL );
|
|
+ int t;
|
|
+ --tp;
|
|
+ t = codep->value;
|
|
+ codep = codep->next;
|
|
+ *tp = (char)t;
|
|
+ } while (codep && tp > op);
|
|
+ assert(occ >= len);
|
|
+ op += len;
|
|
+ occ -= len;
|
|
} else {
|
|
*op++ = (char)code;
|
|
occ--;
|
|
|