Attachment #86490 for bug #129675

Lines 92-97 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_color.c (+5 lines)
92	Yg = TIFFmax(Yg, cielab->display.d_Y0G);	92	Yg = TIFFmax(Yg, cielab->display.d_Y0G);
93	Yb = TIFFmax(Yb, cielab->display.d_Y0B);	93	Yb = TIFFmax(Yb, cielab->display.d_Y0B);
94		94
		95	/* Avoid overflow in case of wrong input values */
		96	Yr = TIFFmin(Yr, cielab->display.d_YCR);
		97	Yg = TIFFmin(Yg, cielab->display.d_YCG);
		98	Yb = TIFFmin(Yb, cielab->display.d_YCB);
		99
95	/* Turn luminosity to colour value. */	100	/* Turn luminosity to colour value. */
96	i = (int)((Yr - cielab->display.d_Y0R) / cielab->rstep);	101	i = (int)((Yr - cielab->display.d_Y0R) / cielab->rstep);
97	i = TIFFmin(cielab->range, i);	102	i = TIFFmin(cielab->range, i);

Lines 784-796 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_dirread.c (-1 / +8 lines)
784	int w = TIFFDataWidth((TIFFDataType) dir->tdir_type);	784	int w = TIFFDataWidth((TIFFDataType) dir->tdir_type);
785	tsize_t cc = dir->tdir_count * w;	785	tsize_t cc = dir->tdir_count * w;
786		786
		787	/* Check for overflow. */
		788	if (!dir->tdir_count \|\| !w \|\| cc / w != (tsize_t)dir->tdir_count)
		789	goto bad;
		790
787	if (!isMapped(tif)) {	791	if (!isMapped(tif)) {
788	if (!SeekOK(tif, dir->tdir_offset))	792	if (!SeekOK(tif, dir->tdir_offset))
789	goto bad;	793	goto bad;
790	if (!ReadOK(tif, cp, cc))	794	if (!ReadOK(tif, cp, cc))
791	goto bad;	795	goto bad;
792	} else {	796	} else {
793	if (dir->tdir_offset + cc > tif->tif_size)	797	/* Check for overflow. */
		798	if ((tsize_t)dir->tdir_offset + cc < (tsize_t)dir->tdir_offset
		799	\|\| (tsize_t)dir->tdir_offset + cc < cc
		800	\|\| (tsize_t)dir->tdir_offset + cc > (tsize_t)tif->tif_size)
794	goto bad;	801	goto bad;
795	_TIFFmemcpy(cp, tif->tif_base + dir->tdir_offset, cc);	802	_TIFFmemcpy(cp, tif->tif_base + dir->tdir_offset, cc);
796	}	803	}

Lines 1059-1064 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_fax3.c (+6 lines)
1059	if (tif->tif_data) {	1059	if (tif->tif_data) {
1060	Fax3CodecState* sp = DecoderState(tif);	1060	Fax3CodecState* sp = DecoderState(tif);
1061		1061
		1062	assert (sp != 0);
		1063	tif->tif_tagmethods.vgetfield = sp->b.vgetparent;
		1064	tif->tif_tagmethods.vsetfield = sp->b.vsetparent;
		1065
1062	if (sp->runs)	1066	if (sp->runs)
1063	_TIFFfree(sp->runs);	1067	_TIFFfree(sp->runs);
1064	if (sp->refline)	1068	if (sp->refline)
Lines 1119-1124 Link Here
1119	Fax3VSetField(TIFF* tif, ttag_t tag, va_list ap)	1123	Fax3VSetField(TIFF* tif, ttag_t tag, va_list ap)
1120	{	1124	{
1121	Fax3BaseState* sp = Fax3State(tif);	1125	Fax3BaseState* sp = Fax3State(tif);
		1126	assert (sp != 0);
		1127	assert (sp->vsetparent != 0);
1122		1128
1123	switch (tag) {	1129	switch (tag) {
1124	case TIFFTAG_FAXMODE:	1130	case TIFFTAG_FAXMODE:




static void
JPEGCleanup(TIFF* tif)
{
	if (tif->tif_data) {
		JPEGState *sp = JState(tif);

		assert (sp != 0);
		tif->tif_tagmethods.vgetfield = sp->vgetparent;
		tif->tif_tagmethods.vsetfield = sp->vsetparent;

                if( sp->cinfo_initialized )
                    TIFFjpeg_destroy(sp);	/* release libjpeg resources */
		if (sp->jpegtables)		/* tag value */
			_TIFFfree(sp->jpegtables);
		_TIFFfree(tif->tif_data);	/* release local state */
		tif->tif_data = NULL;
	}
}

static int

Lines 1002-1007 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_lzw.c (+2 lines)
1002	static void	1002	static void
1003	LZWCleanup(TIFF* tif)	1003	LZWCleanup(TIFF* tif)
1004	{	1004	{
		1005	(void)TIFFPredictorCleanup(tif);
		1006
1005	if (tif->tif_data) {	1007	if (tif->tif_data) {
1006	if (DecoderState(tif)->dec_codetab)	1008	if (DecoderState(tif)->dec_codetab)
1007	_TIFFfree(DecoderState(tif)->dec_codetab);	1009	_TIFFfree(DecoderState(tif)->dec_codetab);

Lines 1163-1169 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_pixarlog.c (-2 / +7 lines)
1163	{	1163	{
1164	PixarLogState* sp = (PixarLogState*) tif->tif_data;	1164	PixarLogState* sp = (PixarLogState*) tif->tif_data;
1165		1165
1166	if (sp) {	1166	assert(sp != 0);
		1167
		1168	(void)TIFFPredictorCleanup(tif);
		1169
		1170	tif->tif_tagmethods.vgetfield = sp->vgetparent;
		1171	tif->tif_tagmethods.vsetfield = sp->vsetparent;
		1172
1167	if (sp->FromLT2) _TIFFfree(sp->FromLT2);	1173	if (sp->FromLT2) _TIFFfree(sp->FromLT2);
1168	if (sp->From14) _TIFFfree(sp->From14);	1174	if (sp->From14) _TIFFfree(sp->From14);
1169	if (sp->From8) _TIFFfree(sp->From8);	1175	if (sp->From8) _TIFFfree(sp->From8);
Lines 1180-1186 Link Here
1180	_TIFFfree(sp->tbuf);	1186	_TIFFfree(sp->tbuf);
1181	_TIFFfree(sp);	1187	_TIFFfree(sp);
1182	tif->tif_data = NULL;	1188	tif->tif_data = NULL;
1183	}
1184	}	1189	}
1185		1190
1186	static int	1191	static int

Lines 519-524 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_predict.c (+24 lines)
519	{	519	{
520	TIFFPredictorState *sp = PredictorState(tif);	520	TIFFPredictorState *sp = PredictorState(tif);
521		521
		522	assert(sp != NULL);
		523	assert(sp->vsetparent != NULL);
		524
522	switch (tag) {	525	switch (tag) {
523	case TIFFTAG_PREDICTOR:	526	case TIFFTAG_PREDICTOR:
524	sp->predictor = (uint16) va_arg(ap, int);	527	sp->predictor = (uint16) va_arg(ap, int);
Lines 536-541 Link Here
536	{	539	{
537	TIFFPredictorState *sp = PredictorState(tif);	540	TIFFPredictorState *sp = PredictorState(tif);
538		541
		542	assert(sp != NULL);
		543	assert(sp->vgetparent != NULL);
		544
539	switch (tag) {	545	switch (tag) {
540	case TIFFTAG_PREDICTOR:	546	case TIFFTAG_PREDICTOR:
541	va_arg(ap, uint16) = sp->predictor;	547	va_arg(ap, uint16) = sp->predictor;
Lines 569-574 Link Here
569	TIFFPredictorInit(TIFF* tif)	575	TIFFPredictorInit(TIFF* tif)
570	{	576	{
571	TIFFPredictorState* sp = PredictorState(tif);	577	TIFFPredictorState* sp = PredictorState(tif);
		578
		579	assert(sp != NULL);
572		580
573	/*	581	/*
574	* Merge codec-specific tag information and	582	* Merge codec-specific tag information and
Lines 595-598 Link Here
595	return 1;	603	return 1;
596	}	604	}
597		605
		606	int
		607	TIFFPredictorCleanup(TIFF* tif)
		608	{
		609	TIFFPredictorState* sp = PredictorState(tif);
		610
		611	assert(sp != 0);
		612
		613	tif->tif_tagmethods.vgetfield = sp->vgetparent;
		614	tif->tif_tagmethods.vsetfield = sp->vsetparent;
		615	tif->tif_tagmethods.printdir = sp->printdir;
		616	tif->tif_setupdecode = sp->setupdecode;
		617	tif->tif_setupencode = sp->setupencode;
		618
		619	return 1;
		620	}
		621
598	/* vim: set ts=8 sts=8 sw=8 noet: */	622	/* vim: set ts=8 sts=8 sw=8 noet: */

Lines 55-60 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_predict.h (+1 lines)
55	extern "C" {	55	extern "C" {
56	#endif	56	#endif
57	extern int TIFFPredictorInit(TIFF*);	57	extern int TIFFPredictorInit(TIFF*);
		58	extern int TIFFPredictorCleanup(TIFF*);
58	#if defined(__cplusplus)	59	#if defined(__cplusplus)
59	}	60	}
60	#endif	61	#endif




ZIPCleanup(TIFF* tif)
{
	ZIPState* sp = ZState(tif);

	assert(sp != 0);

	(void)TIFFPredictorCleanup(tif);

	tif->tif_tagmethods.vgetfield = sp->vgetparent;
	tif->tif_tagmethods.vsetfield = sp->vsetparent;

		if (sp->state&ZSTATE_INIT) {
			/* NB: avoid problems in the library */
			if (tif->tif_mode == O_RDONLY)

		}
		_TIFFfree(sp);
		tif->tif_data = NULL;
	}
}

static int

Return to bug 129675

Lines 1500-1514 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_jpeg.c (-2 / +5 lines)
1500	static void	1500	static void
1501	JPEGCleanup(TIFF* tif)	1501	JPEGCleanup(TIFF* tif)
1502	{	1502	{
1503	if (tif->tif_data) {
1504	JPEGState *sp = JState(tif);	1503	JPEGState *sp = JState(tif);
		1504
		1505	assert (sp != 0);
		1506	tif->tif_tagmethods.vgetfield = sp->vgetparent;
		1507	tif->tif_tagmethods.vsetfield = sp->vsetparent;
		1508
1505	if( sp->cinfo_initialized )	1509	if( sp->cinfo_initialized )
1506	TIFFjpeg_destroy(sp); /* release libjpeg resources */	1510	TIFFjpeg_destroy(sp); /* release libjpeg resources */
1507	if (sp->jpegtables) /* tag value */	1511	if (sp->jpegtables) /* tag value */
1508	_TIFFfree(sp->jpegtables);	1512	_TIFFfree(sp->jpegtables);
1509	_TIFFfree(tif->tif_data); /* release local state */	1513	_TIFFfree(tif->tif_data); /* release local state */
1510	tif->tif_data = NULL;	1514	tif->tif_data = NULL;
1511	}
1512	}	1515	}
1513		1516
1514	static int	1517	static int

Lines 249-255 Link Here

(-)tiff-3.7.4-orig/libtiff/tif_zip.c (-2 / +8 lines)
249	ZIPCleanup(TIFF* tif)	249	ZIPCleanup(TIFF* tif)
250	{	250	{
251	ZIPState* sp = ZState(tif);	251	ZIPState* sp = ZState(tif);
252	if (sp) {	252
		253	assert(sp != 0);
		254
		255	(void)TIFFPredictorCleanup(tif);
		256
		257	tif->tif_tagmethods.vgetfield = sp->vgetparent;
		258	tif->tif_tagmethods.vsetfield = sp->vsetparent;
		259
253	if (sp->state&ZSTATE_INIT) {	260	if (sp->state&ZSTATE_INIT) {
254	/* NB: avoid problems in the library */	261	/* NB: avoid problems in the library */
255	if (tif->tif_mode == O_RDONLY)	262	if (tif->tif_mode == O_RDONLY)
Lines 259-265 Link Here
259	}	266	}
260	_TIFFfree(sp);	267	_TIFFfree(sp);
261	tif->tif_data = NULL;	268	tif->tif_data = NULL;
262	}
263	}	269	}
264		270
265	static int	271	static int