[patch] samples vulnerability patch

tiffdiffliffyiff (text/plain), 3.33 KB, created by Tavis Ormandy (RETIRED) on 2005-05-07 08:56:08 UTC

$ cvs diff -u -r1.51 -r1.53 tif_dirread.c  
Index: tif_dirread.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_dirread.c,v
retrieving revision 1.51
retrieving revision 1.53
diff -u -w -u -r1.51 -r1.53
--- tif_dirread.c       3 Mar 2005 16:00:01 -0000       1.51
+++ tif_dirread.c       6 May 2005 14:35:50 -0000       1.53
@@ -1,4 +1,4 @@
-/* $Id: tif_dirread.c,v 1.51 2005/03/03 16:00:01 dron Exp $ */
+/* $Id: tif_dirread.c,v 1.53 2005/05/06 14:35:50 fwarmerdam Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -1310,12 +1310,16 @@
                uint16 buf[10];
                uint16* v = buf;
 
-               if (samples > NITEMS(buf))
-                       v = (uint16*) CheckMalloc(tif, samples, sizeof(uint16),
+        if (dir->tdir_count > NITEMS(buf))
+            v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof(uint16),
                                                  "to fetch per-sample values");
                if (v && TIFFFetchShortArray(tif, dir, v)) {
                        uint16 i;
-                       for (i = 1; i < samples; i++)
+            int check_count = dir->tdir_count;
+            if( samples < check_count )
+                check_count = samples;
+
+            for (i = 1; i < check_count; i++)
                                if (v[i] != v[0]) {
                                        TIFFError(tif->tif_name,
                "Cannot handle different per-sample values for field \"%s\"",
@@ -1347,12 +1351,16 @@
                uint32 buf[10];
                uint32* v = buf;
 
-               if (samples > NITEMS(buf))
-                       v = (uint32*) CheckMalloc(tif, samples, sizeof(uint32),
+        if (dir->tdir_count > NITEMS(buf))
+            v = (uint32*) CheckMalloc(tif, dir->tdir_count, sizeof(uint32),
                                                  "to fetch per-sample values");
                if (v && TIFFFetchLongArray(tif, dir, v)) {
                        uint16 i;
-                       for (i = 1; i < samples; i++)
+            int check_count = dir->tdir_count;
+
+            if( samples < check_count )
+                check_count = samples;
+            for (i = 1; i < check_count; i++)
                                if (v[i] != v[0]) {
                                        TIFFError(tif->tif_name,
                "Cannot handle different per-sample values for field \"%s\"",
@@ -1384,12 +1392,16 @@
                double buf[10];
                double* v = buf;
 
-               if (samples > NITEMS(buf))
-                       v = (double*) CheckMalloc(tif, samples, sizeof (double),
+        if (dir->tdir_count > NITEMS(buf))
+            v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double),
                                                  "to fetch per-sample values");
                if (v && TIFFFetchAnyArray(tif, dir, v)) {
                        uint16 i;
-                       for (i = 1; i < samples; i++)
+            int check_count = dir->tdir_count;
+            if( samples < check_count )
+                check_count = samples;
+
+            for (i = 1; i < check_count; i++)
                                if (v[i] != v[0]) {
                                        TIFFError(tif->tif_name,
                "Cannot handle different per-sample values for field \"%s\"",