diff options
| author | Ryan Harrison <rharrison@chromium.org> | 2018-04-27 16:08:58 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-04-27 16:08:58 +0000 |
| commit | b1b01de0285c77f16a72736bf6abeb9598743b0a (patch) | |
| tree | 67d1e46245fb8d690cb6c890407b62f6275b49f3 /third_party/libtiff/0028-nstrips-OOM.patch | |
| parent | 7f41d68152885d9b391fd9cc96d9754969b78369 (diff) | |
| download | pdfium-b1b01de0285c77f16a72736bf6abeb9598743b0a.tar.xz | |
Updated libtiff 4.0.8->4.0.9
Applied 0000-build-config.patch
Applied 0006-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
Applied 0008-HeapBufferOverflow-ChopUpSingleUncompressedStrip.patch
Updated and applied 0017-safe_skews_in_gtTileContig.patch
Removed 0025-upstream-OOM-gtTileContig.patch, already applied
Removed 0026-upstream-null-dereference.patch, already applied
Applied 0027-build-config.patch
Updated and applied 0028-nstrips-OOM.patch
BUG=pdfium:1074
Change-Id: I32510327155213fd6256c5a67fa1be3a54cb975c
Reviewed-on: https://pdfium-review.googlesource.com/31550
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Diffstat (limited to 'third_party/libtiff/0028-nstrips-OOM.patch')
| -rw-r--r-- | third_party/libtiff/0028-nstrips-OOM.patch | 37 |
1 files changed, 34 insertions, 3 deletions
diff --git a/third_party/libtiff/0028-nstrips-OOM.patch b/third_party/libtiff/0028-nstrips-OOM.patch index a6db66ee88..33a4b3df57 100644 --- a/third_party/libtiff/0028-nstrips-OOM.patch +++ b/third_party/libtiff/0028-nstrips-OOM.patch @@ -1,5 +1,36 @@ +diff --git a/third_party/libtiff/0028-nstrips-OOM.patch b/third_party/libtiff/0028-nstrips-OOM.patch +index a6db66ee8..e69de29bb 100644 +--- a/third_party/libtiff/0028-nstrips-OOM.patch ++++ b/third_party/libtiff/0028-nstrips-OOM.patch +@@ -1,26 +0,0 @@ +-diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c +-index 772ebaf7d..ab938eac9 100644 +---- a/third_party/libtiff/tif_dirread.c +-+++ b/third_party/libtiff/tif_dirread.c +-@@ -41,6 +41,7 @@ +- +- #include "tiffiop.h" +- #include <float.h> +-+#include <limits.h> +- +- #define IGNORE 0 /* tag placeholder used below */ +- #define FAILED_FII ((uint32) -1) +-@@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif) +- isTiled(tif) ? "tiles" : "strips"); +- goto bad; +- } +-+ if (tif->tif_dir.td_nstrips > INT_MAX) { +-+ TIFFErrorExt(tif->tif_clientdata, module, +-+ "Cannot handle %u number of %s", +-+ tif->tif_dir.td_nstrips, +-+ isTiled(tif) ? "tiles" : "strips"); +-+ goto bad; +-+ } +- tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; +- if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) +- tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel; diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c -index 772ebaf7d..ab938eac9 100644 +index 5e62e8131..521dbf0a4 100644 --- a/third_party/libtiff/tif_dirread.c +++ b/third_party/libtiff/tif_dirread.c @@ -41,6 +41,7 @@ @@ -7,10 +38,10 @@ index 772ebaf7d..ab938eac9 100644 #include "tiffiop.h" #include <float.h> +#include <limits.h> + #include <stdlib.h> #define IGNORE 0 /* tag placeholder used below */ - #define FAILED_FII ((uint32) -1) -@@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif) +@@ -3743,6 +3744,13 @@ TIFFReadDirectory(TIFF* tif) isTiled(tif) ? "tiles" : "strips"); goto bad; } |