diff options
Diffstat (limited to 'third_party/libtiff/0017-safe_skews_in_gtTileContig.patch')
| -rw-r--r-- | third_party/libtiff/0017-safe_skews_in_gtTileContig.patch | 84 |
1 files changed, 42 insertions, 42 deletions
diff --git a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch index 10c5077392..ad6d33daee 100644 --- a/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch +++ b/third_party/libtiff/0017-safe_skews_in_gtTileContig.patch @@ -1,5 +1,5 @@ diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c -index 2861cdd1e..5ed1b7a37 100644 +index 84cc1d1a7..82e19164e 100644 --- a/third_party/libtiff/tif_getimage.c +++ b/third_party/libtiff/tif_getimage.c @@ -31,6 +31,7 @@ @@ -10,7 +10,7 @@ index 2861cdd1e..5ed1b7a37 100644 static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32); static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32); -@@ -612,6 +613,7 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) +@@ -629,6 +628,7 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) uint32 tw, th; unsigned char* buf; int32 fromskew, toskew; @@ -18,22 +18,23 @@ index 2861cdd1e..5ed1b7a37 100644 uint32 nrow; int ret = 1, flip; uint32 this_tw, tocol; -@@ -631,19 +633,37 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) +@@ -649,19 +647,37 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { - y = h - 1; -- toskew = -(int32)(tw + w); -+ safeskew = 0; -+ safeskew -= tw; -+ safeskew -= w; + y = h - 1; +- toskew = -(int32)(tw + w); ++ safeskew = 0; ++ safeskew -= tw; ++ safeskew -= w; } else { - y = 0; -- toskew = -(int32)(tw - w); -+ safeskew = 0; -+ safeskew -= tw; -+ safeskew +=w; + y = 0; +- toskew = -(int32)(tw - w); ++ safeskew = 0; ++ safeskew -= tw; ++ safeskew +=w; } + + if(safeskew > INT_MAX || safeskew < INT_MIN){ + _TIFFfree(buf); + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); @@ -41,9 +42,8 @@ index 2861cdd1e..5ed1b7a37 100644 + } + toskew = safeskew; + - /* - * Leftmost tile is clipped on left side if col_offset > 0. + * Leftmost tile is clipped on left side if col_offset > 0. */ leftmost_fromskew = img->col_offset % tw; leftmost_tw = tw - leftmost_fromskew; @@ -59,30 +59,30 @@ index 2861cdd1e..5ed1b7a37 100644 for (row = 0; row < h; row += nrow) { rowstoread = th - (row + img->row_offset) % th; -@@ -668,9 +688,24 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) - /* - * Rightmost tile is clipped on right side. - */ -- fromskew = tw - (w - tocol); -+ safeskew = tw; -+ safeskew -= w; -+ safeskew += tocol; -+ if(safeskew > INT_MAX || safeskew < INT_MIN){ -+ _TIFFfree(buf); -+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); -+ return (0); -+ } -+ fromskew = safeskew; - this_tw = tw - fromskew; -- this_toskew = toskew + fromskew; -+ safeskew = toskew; -+ safeskew += fromskew; -+ if(safeskew > INT_MAX || safeskew < INT_MIN){ -+ _TIFFfree(buf); -+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); -+ return (0); -+ } -+ this_toskew = safeskew; - } - (*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, buf + pos); - tocol += this_tw; +@@ -704,9 +684,24 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) + /* + * Rightmost tile is clipped on right side. + */ +- fromskew = tw - (w - tocol); ++ safeskew = tw; ++ safeskew -= w; ++ safeskew += tocol; ++ if(safeskew > INT_MAX || safeskew < INT_MIN){ ++ _TIFFfree(buf); ++ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); ++ return (0); ++ } ++ fromskew = safeskew; + this_tw = tw - fromskew; +- this_toskew = toskew + fromskew; ++ safeskew = toskew; ++ safeskew += fromskew; ++ if(safeskew > INT_MAX || safeskew < INT_MIN){ ++ _TIFFfree(buf); ++ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "Invalid skew"); ++ return (0); ++ } ++ this_toskew = safeskew; + } + (*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, buf + pos); + tocol += this_tw; |