From d3c6f8119a4c6cd143c6f2f3f874705f57afaf36 Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Fri, 28 Jul 2017 13:23:59 -0400 Subject: LibTIFF: upstream patch to fix null dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This CL applies this patch that fixes a recent null dereference regression: https://github.com/vadz/libtiff/commit/57f4b28c00d78bd5d74768585d0e46b2e12e94f7 Bug: chromium:743621 Change-Id: I0f9d4321dc6ea71dd31cf0ba8420cc25d401f0d8 Reviewed-on: https://pdfium-review.googlesource.com/9490 Reviewed-by: Tom Sepez Commit-Queue: Nicolás Peña --- .../libtiff/0026-upstream-null-dereference.patch | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 third_party/libtiff/0026-upstream-null-dereference.patch (limited to 'third_party/libtiff/0026-upstream-null-dereference.patch') diff --git a/third_party/libtiff/0026-upstream-null-dereference.patch b/third_party/libtiff/0026-upstream-null-dereference.patch new file mode 100644 index 0000000000..052645ff8a --- /dev/null +++ b/third_party/libtiff/0026-upstream-null-dereference.patch @@ -0,0 +1,22 @@ +diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c +index 03c9a81fb..d37f729c4 100644 +--- a/third_party/libtiff/tif_getimage.c ++++ b/third_party/libtiff/tif_getimage.c +@@ -681,7 +681,7 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) + return (0); + } + leftmost_toskew = safeskew; +- for (row = 0; row < h; row += nrow) ++ for (row = 0; ret != 0 && row < h; row += nrow) + { + rowstoread = th - (row + img->row_offset) % th; + nrow = (row + rowstoread > h ? h - row : rowstoread); +@@ -830,7 +830,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) + leftmost_fromskew = img->col_offset % tw; + leftmost_tw = tw - leftmost_fromskew; + leftmost_toskew = toskew + leftmost_fromskew; +- for (row = 0; row < h; row += nrow) ++ for (row = 0; ret != 0 && row < h; row += nrow) + { + rowstoread = th - (row + img->row_offset) % th; + nrow = (row + rowstoread > h ? h - row : rowstoread); -- cgit v1.2.3