diff options
Diffstat (limited to 'media-libs/tiff/files/tiff-4.0.7-bug2639.patch')
| -rw-r--r-- | media-libs/tiff/files/tiff-4.0.7-bug2639.patch | 58 |
1 files changed, 0 insertions, 58 deletions
diff --git a/media-libs/tiff/files/tiff-4.0.7-bug2639.patch b/media-libs/tiff/files/tiff-4.0.7-bug2639.patch deleted file mode 100644 index b894775dc703..000000000000 --- a/media-libs/tiff/files/tiff-4.0.7-bug2639.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 6a61192a98665d870dcb835452cb9c5757ccd27c Mon Sep 17 00:00:00 2001 -From: Even Rouault <even.rouault@spatialys.com> -Date: Tue, 20 Dec 2016 17:24:35 +0000 -Subject: [PATCH] * tools/tiff2pdf.c: avoid potential invalid memory read in - t2p_writeproc. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2639 - ---- - ChangeLog | 6 ++++++ - tools/tiff2pdf.c | 20 +++++++++++--------- - 2 files changed, 17 insertions(+), 9 deletions(-) - -diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c -index 78ffa77d123a..5348f1a765fe 100644 ---- a/tools/tiff2pdf.c -+++ b/tools/tiff2pdf.c -@@ -2896,6 +2896,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ - } - if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) { - if (count >= 4) { -+ int retTIFFReadRawTile; - /* Ignore EOI marker of JpegTables */ - _TIFFmemcpy(buffer, jpt, count - 2); - bufferoffset += count - 2; -@@ -2903,22 +2904,23 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_ - table_end[0] = buffer[bufferoffset-2]; - table_end[1] = buffer[bufferoffset-1]; - xuint32 = bufferoffset; -- bufferoffset -= 2; -- bufferoffset += TIFFReadRawTile( -+ bufferoffset -= 2; -+ retTIFFReadRawTile= TIFFReadRawTile( - input, - tile, - (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), - -1); -+ if( retTIFFReadRawTile < 0 ) -+ { -+ _TIFFfree(buffer); -+ t2p->t2p_error = T2P_ERR_ERROR; -+ return(0); -+ } -+ bufferoffset += retTIFFReadRawTile; - /* Overwrite SOI marker of image scan with previously */ - /* saved end of JpegTables */ - buffer[xuint32-2]=table_end[0]; - buffer[xuint32-1]=table_end[1]; -- } else { -- bufferoffset += TIFFReadRawTile( -- input, -- tile, -- (tdata_t) &(((unsigned char*)buffer)[bufferoffset]), -- -1); - } - } - t2pWriteFile(output, (tdata_t) buffer, bufferoffset); --- -2.12.0 - |