diff options
| author | Eirik Aavitsland <eirik.aavitsland@theqtcompany.com> | 2015-11-25 14:25:31 +0100 |
|---|---|---|
| committer | aavit <eirik.aavitsland@theqtcompany.com> | 2015-12-09 12:25:16 +0000 |
| commit | 6730d70f001c9492d32a6a8e95c304a52d7ddc35 (patch) | |
| tree | 1553ae391ec42af87ba32a52fa28f3cea2764980 /src/3rdparty/libtiff/libtiff/tif_pixarlog.c | |
| parent | de4f14476c24eb4cf52948af92220a2a6462c823 (diff) | |
Bundled libtiff updated to version 4.0.6v5.6.0-beta1
Upstream changes since 4.0.3 have been merged in. Our local tif_conf.h
have been updated according to the upstream changes in tif_conf.h.in.
Change-Id: I1c2aef6f0f60377de4876e25df723c32a6f95ea6
Reviewed-by: Liang Qi <liang.qi@theqtcompany.com>
Diffstat (limited to 'src/3rdparty/libtiff/libtiff/tif_pixarlog.c')
| -rw-r--r-- | src/3rdparty/libtiff/libtiff/tif_pixarlog.c | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/src/3rdparty/libtiff/libtiff/tif_pixarlog.c b/src/3rdparty/libtiff/libtiff/tif_pixarlog.c index e583117..044c411 100644 --- a/src/3rdparty/libtiff/libtiff/tif_pixarlog.c +++ b/src/3rdparty/libtiff/libtiff/tif_pixarlog.c @@ -1,4 +1,4 @@ -/* $Id: tif_pixarlog.c,v 1.38 2012-06-21 01:01:53 fwarmerdam Exp $ */ +/* $Id: tif_pixarlog.c,v 1.39 2012-12-10 17:27:13 tgl Exp $ */ /* * Copyright (c) 1996-1997 Sam Leffler @@ -644,6 +644,20 @@ multiply_ms(tmsize_t m1, tmsize_t m2) return bytes; } +static tmsize_t +add_ms(tmsize_t m1, tmsize_t m2) +{ + tmsize_t bytes = m1 + m2; + + /* if either input is zero, assume overflow already occurred */ + if (m1 == 0 || m2 == 0) + bytes = 0; + else if (bytes <= m1 || bytes <= m2) + bytes = 0; + + return bytes; +} + static int PixarLogFixupTags(TIFF* tif) { @@ -671,9 +685,11 @@ PixarLogSetupDecode(TIFF* tif) td->td_samplesperpixel : 1); tbuf_size = multiply_ms(multiply_ms(multiply_ms(sp->stride, td->td_imagewidth), td->td_rowsperstrip), sizeof(uint16)); + /* add one more stride in case input ends mid-stride */ + tbuf_size = add_ms(tbuf_size, sizeof(uint16) * sp->stride); if (tbuf_size == 0) return (0); /* TODO: this is an error return without error report through TIFFErrorExt */ - sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size+sizeof(uint16)*sp->stride); + sp->tbuf = (uint16 *) _TIFFmalloc(tbuf_size); if (sp->tbuf == NULL) return (0); if (sp->user_datafmt == PIXARLOGDATAFMT_UNKNOWN) |