diff options
| author | Lei Zhang <thestig@chromium.org> | 2017-03-20 15:46:06 -0700 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-03-21 13:12:16 +0000 |
| commit | cfb6f46473777e444c8124318aa78d33aae64459 (patch) | |
| tree | 272d17a7ba02251fd6d62a90c431e5af169af85a /third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch | |
| parent | 34a28b470a9a4d7c7edd04e9b6a1e02a7490e58b (diff) | |
| download | pdfium-cfb6f46473777e444c8124318aa78d33aae64459.tar.xz | |
Upgrade libtiff to 4.0.7.
Change-Id: If3f67767f738b7f23230ca8c37c9af2e31696e82
Reviewed-on: https://pdfium-review.googlesource.com/3117
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch')
| -rw-r--r-- | third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch | 33 |
1 files changed, 0 insertions, 33 deletions
diff --git a/third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch b/third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch deleted file mode 100644 index 57dbe2efb7..0000000000 --- a/third_party/libtiff/0009-HeapBufferOverflow-PixarLogDecode.patch +++ /dev/null @@ -1,33 +0,0 @@ -diff --git a/third_party/libtiff/tif_pixarlog.c b/third_party/libtiff/tif_pixarlog.c -index b93b4c7..0674fa4 100644 ---- a/third_party/libtiff/tif_pixarlog.c -+++ b/third_party/libtiff/tif_pixarlog.c -@@ -457,6 +457,7 @@ horizontalAccumulate8abgr(uint16 *wp, int n, int stride, unsigned char *op, - typedef struct { - TIFFPredictorState predict; - z_stream stream; -+ tmsize_t tbuf_size; /* only set/used on reading for now */ - uint16 *tbuf; - uint16 stride; - int state; -@@ -692,6 +693,7 @@ PixarLogSetupDecode(TIFF* tif) - sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size); - if (sp->tbuf == NULL) - return (0); -+ sp->tbuf_size = tbuf_size; - if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) - sp->user_datafmt = PixarLogGuessDataFmt(td); - if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) { -@@ -781,6 +783,12 @@ PixarLogDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s) - TIFFErrorExt(tif->tif_clientdata, module, "ZLib cannot deal with buffers this size"); - return (0); - } -+ /* Check that we will not fill more than what was allocated */ -+ if ((tmsize_t)sp->stream.avail_out > sp->tbuf_size) -+ { -+ TIFFErrorExt(tif->tif_clientdata, module, "sp->stream.avail_out > sp->tbuf_size"); -+ return (0); -+ } - do { - int state = inflate(&sp->stream, Z_PARTIAL_FLUSH); - if (state == Z_STREAM_END) { |