Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 58276 Details for
Bug 91584
media-libs/tiff: buffer overflow
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
samples vulnerability patch
tiffdiffliffyiff (text/plain), 3.33 KB, created by
Tavis Ormandy (RETIRED)
on 2005-05-07 08:56:08 UTC
(
hide
)
Description:
samples vulnerability patch
Filename:
MIME Type:
Creator:
Tavis Ormandy (RETIRED)
Created:
2005-05-07 08:56:08 UTC
Size:
3.33 KB
patch
obsolete
>$ cvs diff -u -r1.51 -r1.53 tif_dirread.c >Index: tif_dirread.c >=================================================================== >RCS file: /cvs/maptools/cvsroot/libtiff/libtiff/tif_dirread.c,v >retrieving revision 1.51 >retrieving revision 1.53 >diff -u -w -u -r1.51 -r1.53 >--- tif_dirread.c 3 Mar 2005 16:00:01 -0000 1.51 >+++ tif_dirread.c 6 May 2005 14:35:50 -0000 1.53 >@@ -1,4 +1,4 @@ >-/* $Id: tif_dirread.c,v 1.51 2005/03/03 16:00:01 dron Exp $ */ >+/* $Id: tif_dirread.c,v 1.53 2005/05/06 14:35:50 fwarmerdam Exp $ */ > > /* > * Copyright (c) 1988-1997 Sam Leffler >@@ -1310,12 +1310,16 @@ > uint16 buf[10]; > uint16* v = buf; > >- if (samples > NITEMS(buf)) >- v = (uint16*) CheckMalloc(tif, samples, sizeof(uint16), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof(uint16), > "to fetch per-sample values"); > if (v && TIFFFetchShortArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ if( samples < check_count ) >+ check_count = samples; >+ >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"", >@@ -1347,12 +1351,16 @@ > uint32 buf[10]; > uint32* v = buf; > >- if (samples > NITEMS(buf)) >- v = (uint32*) CheckMalloc(tif, samples, sizeof(uint32), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (uint32*) CheckMalloc(tif, dir->tdir_count, sizeof(uint32), > "to fetch per-sample values"); > if (v && TIFFFetchLongArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ >+ if( samples < check_count ) >+ check_count = samples; >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"", >@@ -1384,12 +1392,16 @@ > double buf[10]; > double* v = buf; > >- if (samples > NITEMS(buf)) >- v = (double*) CheckMalloc(tif, samples, sizeof (double), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double), > "to fetch per-sample values"); > if (v && TIFFFetchAnyArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ if( samples < check_count ) >+ check_count = samples; >+ >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"", >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 91584
: 58276