You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
26 lines
903 B
26 lines
903 B
7 years ago
|
From 77ac8e9fd9b2c1aeec3951e2bb50f7cc2c1e92d2 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Sebastian Pipping <sebastian@pipping.org>
|
||
|
|
Date: Sun, 19 Nov 2017 16:04:26 +0100
|
||
|
|
Subject: [PATCH] Prevent integer overflow (bug #65, CVE-2017-1000229)
|
||
|
|
|
||
|
|
---
|
||
|
|
src/minitiff/tiffread.c | 2 ++
|
||
|
|
1 file changed, 2 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
|
||
|
|
index b4910ec..5f9b376 100644
|
||
|
|
--- a/src/minitiff/tiffread.c
|
||
|
|
+++ b/src/minitiff/tiffread.c
|
||
|
|
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
|
||
|
|
count = tiff_ptr->strip_offsets_count;
|
||
|
|
if (count == 0 || count > tiff_ptr->height)
|
||
|
|
goto err_invalid;
|
||
|
|
+ if (count > (size_t)-1 / sizeof(long))
|
||
|
|
+ goto err_memory;
|
||
|
|
tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
|
||
|
|
if (tiff_ptr->strip_offsets == NULL)
|
||
|
|
goto err_memory;
|
||
|
|
--
|
||
|
|
2.14.2
|
||
|
|
|