39 lines
1.3 KiB
Plaintext
39 lines
1.3 KiB
Plaintext
$OpenBSD: patch-src_common_imagtiff_cpp,v 1.1 2009/06/11 08:32:42 jasper Exp $
|
|
|
|
Security fix for part 2 or SA35292 (wxWidgets Double Free Vulnerability).
|
|
Patch from upstream svn -r60879 and -r60897.
|
|
|
|
--- src/common/imagtiff.cpp.orig Wed Nov 21 13:41:57 2007
|
|
+++ src/common/imagtiff.cpp Thu Jun 11 10:12:09 2009
|
|
@@ -261,7 +261,6 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputS
|
|
}
|
|
|
|
uint32 w, h;
|
|
- uint32 npixels;
|
|
uint32 *raster;
|
|
|
|
TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );
|
|
@@ -275,9 +274,20 @@ bool wxTIFFHandler::LoadFile( wxImage *image, wxInputS
|
|
(samplesInfo[0] == EXTRASAMPLE_ASSOCALPHA ||
|
|
samplesInfo[0] == EXTRASAMPLE_UNASSALPHA));
|
|
|
|
- npixels = w * h;
|
|
+ // guard against integer overflow during multiplication which could result
|
|
+ // in allocating a too small buffer and then overflowing it
|
|
+ const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
|
|
+ if ( bytesNeeded >= 4294967295U /* UINT32_MAX */ )
|
|
+ {
|
|
+ if ( verbose )
|
|
+ wxLogError( _("TIFF: Image size is abnormally big.") );
|
|
|
|
- raster = (uint32*) _TIFFmalloc( npixels * sizeof(uint32) );
|
|
+ TIFFClose(tif);
|
|
+
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ raster = (uint32*) _TIFFmalloc( bytesNeeded );
|
|
|
|
if (!raster)
|
|
{
|