Attachment #197767 for bug #276988




#undef LumaBlue
#undef V2Code

static tsize_t
multiply(tsize_t m1, tsize_t m2)
{
    tsize_t prod = m1 * m2;

    if (m1 && prod / m1 != m2)
        prod = 0;		/* overflow */

    return prod;
}

/*
 * Convert a strip of RGB data to YCbCr and
 * sample to generate the output data.

	float floatv;
	char *stringv;
	uint32 longv;
	tsize_t raster_size;

	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);

	raster_size = multiply(multiply(width, height), sizeof (uint32));
	if (!raster_size) {
		TIFFError(TIFFFileName(in),
			  "Can't allocate buffer for raster of size %lux%lu",
			  (unsigned long) width, (unsigned long) height);
		return (0);
	}
	raster = (uint32*)_TIFFmalloc(raster_size);
	if (raster == 0) {
		TIFFError(TIFFFileName(in), "No space for raster buffer");
		return (0);

Lines 124-129 Link Here

(-)tiff-3.8.2.orig/tools/tiff2rgba.c (-7 / +42 lines)
124	return (0);	124	return (0);
125	}	125	}
126		126
		127	static tsize_t
		128	multiply(tsize_t m1, tsize_t m2)
		129	{
		130	tsize_t prod = m1 * m2;
		131
		132	if (m1 && prod / m1 != m2)
		133	prod = 0; /* overflow */
		134
		135	return prod;
		136	}
		137
127	static int	138	static int
128	cvt_by_tile( TIFF in, TIFF out )	139	cvt_by_tile( TIFF in, TIFF out )
129		140
Lines 133-138 Link Here
133	uint32 tile_width, tile_height;	144	uint32 tile_width, tile_height;
134	uint32 row, col;	145	uint32 row, col;
135	uint32 *wrk_line;	146	uint32 *wrk_line;
		147	tsize_t raster_size;
136	int ok = 1;	148	int ok = 1;
137		149
138	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);	150	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
Lines 150-156 Link Here
150	/*	162	/*
151	* Allocate tile buffer	163	* Allocate tile buffer
152	*/	164	*/
153	raster = (uint32)_TIFFmalloc(tile_width tile_height * sizeof (uint32));	165	raster_size = multiply(multiply(tile_width, tile_height), sizeof (uint32));
		166	if (!raster_size) {
		167	TIFFError(TIFFFileName(in),
		168	"Can't allocate buffer for raster of size %lux%lu",
		169	(unsigned long) tile_width, (unsigned long) tile_height);
		170	return (0);
		171	}
		172	raster = (uint32*)_TIFFmalloc(raster_size);
154	if (raster == 0) {	173	if (raster == 0) {
155	TIFFError(TIFFFileName(in), "No space for raster buffer");	174	TIFFError(TIFFFileName(in), "No space for raster buffer");
156	return (0);	175	return (0);
Lines 158-164 Link Here
158		177
159	/*	178	/*
160	* Allocate a scanline buffer for swapping during the vertical	179	* Allocate a scanline buffer for swapping during the vertical
161	* mirroring pass.	180	* mirroring pass. (Request can't overflow given prior checks.)
162	*/	181	*/
163	wrk_line = (uint32)_TIFFmalloc(tile_width sizeof (uint32));	182	wrk_line = (uint32)_TIFFmalloc(tile_width sizeof (uint32));
164	if (!wrk_line) {	183	if (!wrk_line) {
Lines 226-231 Link Here
226	uint32 width, height; /* image width & height */	245	uint32 width, height; /* image width & height */
227	uint32 row;	246	uint32 row;
228	uint32 *wrk_line;	247	uint32 *wrk_line;
		248	tsize_t raster_size;
229	int ok = 1;	249	int ok = 1;
230		250
231	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);	251	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
Lines 241-247 Link Here
241	/*	261	/*
242	* Allocate strip buffer	262	* Allocate strip buffer
243	*/	263	*/
244	raster = (uint32)_TIFFmalloc(width rowsperstrip * sizeof (uint32));	264	raster_size = multiply(multiply(width, rowsperstrip), sizeof (uint32));
		265	if (!raster_size) {
		266	TIFFError(TIFFFileName(in),
		267	"Can't allocate buffer for raster of size %lux%lu",
		268	(unsigned long) width, (unsigned long) rowsperstrip);
		269	return (0);
		270	}
		271	raster = (uint32*)_TIFFmalloc(raster_size);
245	if (raster == 0) {	272	if (raster == 0) {
246	TIFFError(TIFFFileName(in), "No space for raster buffer");	273	TIFFError(TIFFFileName(in), "No space for raster buffer");
247	return (0);	274	return (0);
Lines 249-255 Link Here
249		276
250	/*	277	/*
251	* Allocate a scanline buffer for swapping during the vertical	278	* Allocate a scanline buffer for swapping during the vertical
252	* mirroring pass.	279	* mirroring pass. (Request can't overflow given prior checks.)
253	*/	280	*/
254	wrk_line = (uint32)_TIFFmalloc(width sizeof (uint32));	281	wrk_line = (uint32)_TIFFmalloc(width sizeof (uint32));
255	if (!wrk_line) {	282	if (!wrk_line) {
Lines 328-341 Link Here
328	uint32* raster; /* retrieve RGBA image */	355	uint32* raster; /* retrieve RGBA image */
329	uint32 width, height; /* image width & height */	356	uint32 width, height; /* image width & height */
330	uint32 row;	357	uint32 row;
331		358	tsize_t raster_size;
		359
332	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);	360	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
333	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);	361	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
334		362
335	rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip);	363	rowsperstrip = TIFFDefaultStripSize(out, rowsperstrip);
336	TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip);	364	TIFFSetField(out, TIFFTAG_ROWSPERSTRIP, rowsperstrip);
337		365
338	raster = (uint32)_TIFFmalloc(width height * sizeof (uint32));	366	raster_size = multiply(multiply(width, height), sizeof (uint32));
		367	if (!raster_size) {
		368	TIFFError(TIFFFileName(in),
		369	"Can't allocate buffer for raster of size %lux%lu",
		370	(unsigned long) width, (unsigned long) height);
		371	return (0);
		372	}
		373	raster = (uint32*)_TIFFmalloc(raster_size);
339	if (raster == 0) {	374	if (raster == 0) {
340	TIFFError(TIFFFileName(in), "No space for raster buffer");	375	TIFFError(TIFFFileName(in), "No space for raster buffer");
341	return (0);	376	return (0);
Lines 353-359 Link Here
353	*/	388	*/
354	if( no_alpha )	389	if( no_alpha )
355	{	390	{
356	int pixel_count = width * height;	391	tsize_t pixel_count = (tsize_t) width * (tsize_t) height;
357	unsigned char src, dst;	392	unsigned char src, dst;
358		393
359	src = (unsigned char *) raster;	394	src = (unsigned char *) raster;

Return to bug 276988

Lines 202-207 Link Here

(-)tiff-3.8.2.orig/tools/rgb2ycbcr.c (-1 / +21 lines)
202	#undef LumaBlue	202	#undef LumaBlue
203	#undef V2Code	203	#undef V2Code
204		204
		205	static tsize_t
		206	multiply(tsize_t m1, tsize_t m2)
		207	{
		208	tsize_t prod = m1 * m2;
		209
		210	if (m1 && prod / m1 != m2)
		211	prod = 0; /* overflow */
		212
		213	return prod;
		214	}
		215
205	/*	216	/*
206	* Convert a strip of RGB data to YCbCr and	217	* Convert a strip of RGB data to YCbCr and
207	* sample to generate the output data.	218	* sample to generate the output data.
Lines 278-287 Link Here
278	float floatv;	289	float floatv;
279	char *stringv;	290	char *stringv;
280	uint32 longv;	291	uint32 longv;
		292	tsize_t raster_size;
281		293
282	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);	294	TIFFGetField(in, TIFFTAG_IMAGEWIDTH, &width);
283	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);	295	TIFFGetField(in, TIFFTAG_IMAGELENGTH, &height);
284	raster = (uint32)_TIFFmalloc(width height * sizeof (uint32));	296
		297	raster_size = multiply(multiply(width, height), sizeof (uint32));
		298	if (!raster_size) {
		299	TIFFError(TIFFFileName(in),
		300	"Can't allocate buffer for raster of size %lux%lu",
		301	(unsigned long) width, (unsigned long) height);
		302	return (0);
		303	}
		304	raster = (uint32*)_TIFFmalloc(raster_size);
285	if (raster == 0) {	305	if (raster == 0) {
286	TIFFError(TIFFFileName(in), "No space for raster buffer");	306	TIFFError(TIFFFileName(in), "No space for raster buffer");
287	return (0);	307	return (0);