diff options
Diffstat (limited to 'src/3rdparty/libtiff/libtiff/tif_fax3.h')
| -rw-r--r-- | src/3rdparty/libtiff/libtiff/tif_fax3.h | 39 |
1 files changed, 34 insertions, 5 deletions
diff --git a/src/3rdparty/libtiff/libtiff/tif_fax3.h b/src/3rdparty/libtiff/libtiff/tif_fax3.h index abadcd9..701716c 100644 --- a/src/3rdparty/libtiff/libtiff/tif_fax3.h +++ b/src/3rdparty/libtiff/libtiff/tif_fax3.h @@ -240,6 +240,11 @@ static const char* StateNames[] = { * current row and reset decoding state. */ #define SETVALUE(x) do { \ + if (pa >= thisrun + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ *pa++ = RunLength + (x); \ a0 += (x); \ RunLength = 0; \ @@ -377,6 +382,11 @@ done1d: \ */ #define CHECK_b1 do { \ if (pa != thisrun) while (b1 <= a0 && b1 < lastx) { \ + if( pb + 1 >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += pb[0] + pb[1]; \ pb += 2; \ } \ @@ -387,10 +397,20 @@ done1d: \ */ #define EXPAND2D(eoflab) do { \ while (a0 < lastx) { \ + if (pa >= thisrun + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ LOOKUP8(7, TIFFFaxMainTable, eof2d); \ switch (TabEnt->State) { \ case S_Pass: \ CHECK_b1; \ + if( pb + 1 >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ RunLength += b1 - a0; \ a0 = b1; \ @@ -469,20 +489,28 @@ done1d: \ case S_V0: \ CHECK_b1; \ SETVALUE(b1 - a0); \ + if( pb >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ break; \ case S_VR: \ CHECK_b1; \ SETVALUE(b1 - a0 + TabEnt->Param); \ + if( pb >= sp->refruns + sp->nruns) { \ + TIFFErrorExt(tif->tif_clientdata, module, "Buffer overflow at line %u of %s %u", \ + sp->line, isTiled(tif) ? "tile" : "strip", isTiled(tif) ? tif->tif_curtile : tif->tif_curstrip); \ + return (-1); \ + } \ b1 += *pb++; \ break; \ case S_VL: \ CHECK_b1; \ - if (b1 <= (int) (a0 + TabEnt->Param)) { \ - if (b1 < (int) (a0 + TabEnt->Param) || pa != thisrun) { \ - unexpected("VL", a0); \ - goto eol2d; \ - } \ + if (b1 < (int) (a0 + TabEnt->Param)) { \ + unexpected("VL", a0); \ + goto eol2d; \ } \ SETVALUE(b1 - a0 - TabEnt->Param); \ b1 -= *--pb; \ @@ -529,6 +557,7 @@ eol2d: \ CLEANUP_RUNS(); \ } while (0) #endif /* _FAX3_ */ +/* vim: set ts=8 sts=4 sw=4 noet: */ /* * Local Variables: * mode: c |