openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_getimage_c
brad f81e2e0341 Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
2004-10-20 20:37:48 +00:00

55 lines
1.8 KiB
Plaintext

$OpenBSD: patch-libtiff_tif_getimage_c,v 1.1 2004/10/20 20:37:48 brad Exp $
--- libtiff/tif_getimage.c.orig Mon Dec 22 03:22:15 2003
+++ libtiff/tif_getimage.c Wed Oct 20 14:38:11 2004
@@ -565,6 +565,7 @@ gtTileContig(TIFFRGBAImage* img, uint32*
TIFFError(TIFFFileName(tif), "No space for tile buffer");
return (0);
}
+ _TIFFmemset(buf, 0, TIFFTileSize(tif));
TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);
TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);
@@ -664,6 +665,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint3
TIFFError(TIFFFileName(tif), "No space for tile buffer");
return (0);
}
+ _TIFFmemset(buf, 0, 4*tilesize);
r = buf;
g = r + tilesize;
b = g + tilesize;
@@ -727,9 +729,7 @@ gtTileSeparate(TIFFRGBAImage* img, uint3
(*put)(img, raster+y*w+col, col, y,
npix, nrow, fromskew, toskew + fromskew,
r + pos, g + pos, b + pos, a + pos);
- }
- else
- {
+ } else {
(*put)(img, raster+y*w+col, col, y,
tw, nrow, 0, toskew, r + pos, g + pos, b + pos, a + pos);
}
@@ -783,13 +783,13 @@ gtStripContig(TIFFRGBAImage* img, uint32
TIFFError(TIFFFileName(tif), "No space for strip buffer");
return (0);
}
+ _TIFFmemset(buf, 0, TIFFStripSize(tif));
flip = setorientation(img);
if (flip & FLIP_VERTICALLY) {
y = h - 1;
toskew = -(int32)(w + w);
- }
- else {
+ } else {
y = 0;
toskew = -(int32)(w - w);
}
@@ -865,6 +865,7 @@ gtStripSeparate(TIFFRGBAImage* img, uint
TIFFError(TIFFFileName(tif), "No space for tile buffer");
return (0);
}
+ _TIFFmemset(buf, 0, 4*stripsize);
g = r + stripsize;
b = g + stripsize;
a = b + stripsize;