diff options
| author | Liang Qi <liang.qi@qt.io> | 2017-01-26 09:59:43 +0100 |
|---|---|---|
| committer | Liang Qi <liang.qi@qt.io> | 2017-01-26 09:59:43 +0100 |
| commit | 8f045f413e935ef9e7fdcef55c52343686a0f1aa (patch) | |
| tree | 273230a3c167830828106002137e33a981c5a04d /src/3rdparty/libtiff/libtiff/tif_next.c | |
| parent | 0870e670665a702665948723bb7b1eb61a9572a8 (diff) | |
| parent | cd2de115c6216ad747cf4803e65a4ce4af220795 (diff) | |
Merge remote-tracking branch 'origin/5.8.0' into 5.8
Change-Id: I8a8151eb2dd01059cf86da8f72ecb65612bff0c1
Diffstat (limited to 'src/3rdparty/libtiff/libtiff/tif_next.c')
| -rw-r--r-- | src/3rdparty/libtiff/libtiff/tif_next.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/src/3rdparty/libtiff/libtiff/tif_next.c b/src/3rdparty/libtiff/libtiff/tif_next.c index 17e0311..0821178 100644 --- a/src/3rdparty/libtiff/libtiff/tif_next.c +++ b/src/3rdparty/libtiff/libtiff/tif_next.c @@ -1,4 +1,4 @@ -/* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */ +/* $Id: tif_next.c,v 1.19 2016-09-04 21:32:56 erouault Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -37,7 +37,7 @@ case 0: op[0] = (unsigned char) ((v) << 6); break; \ case 1: op[0] |= (v) << 4; break; \ case 2: op[0] |= (v) << 2; break; \ - case 3: *op++ |= (v); break; \ + case 3: *op++ |= (v); op_offset++; break; \ } \ } @@ -72,7 +72,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) return (0); } for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) { - n = *bp++, cc--; + n = *bp++; + cc--; switch (n) { case LITERALROW: /* @@ -103,6 +104,7 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) } default: { uint32 npixels = 0, grey; + tmsize_t op_offset = 0; uint32 imagewidth = tif->tif_dir.td_imagewidth; if( isTiled(tif) ) imagewidth = tif->tif_dir.td_tilewidth; @@ -122,13 +124,19 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s) * bounds, potentially resulting in a security * issue. */ - while (n-- > 0 && npixels < imagewidth) + while (n-- > 0 && npixels < imagewidth && op_offset < scanline) SETPIXEL(op, grey); if (npixels >= imagewidth) break; + if (op_offset >= scanline ) { + TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld", + (long) tif->tif_row); + return (0); + } if (cc == 0) goto bad; - n = *bp++, cc--; + n = *bp++; + cc--; } break; } |