96 lines
3.6 KiB
Plaintext
96 lines
3.6 KiB
Plaintext
$OpenBSD: patch-libtiff_tif_dir_c,v 1.4 2009/03/07 15:31:57 naddy Exp $
|
|
|
|
CVE-2006-3464,3465
|
|
|
|
--- libtiff/tif_dir.c.orig Tue Mar 21 09:42:50 2006
|
|
+++ libtiff/tif_dir.c Fri Mar 6 08:29:08 2009
|
|
@@ -122,6 +122,7 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
{
|
|
static const char module[] = "_TIFFVSetField";
|
|
|
|
+ const TIFFFieldInfo* fip = _TIFFFindFieldInfo(tif, tag, TIFF_ANY);
|
|
TIFFDirectory* td = &tif->tif_dir;
|
|
int status = 1;
|
|
uint32 v32, i, v;
|
|
@@ -196,9 +197,11 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
case TIFFTAG_ORIENTATION:
|
|
v = va_arg(ap, uint32);
|
|
if (v < ORIENTATION_TOPLEFT || ORIENTATION_LEFTBOT < v) {
|
|
+ const TIFFFieldInfo* fip;
|
|
+ fip = _TIFFFieldWithTag(tif, tag);
|
|
TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
|
|
"Bad value %lu for \"%s\" tag ignored",
|
|
- v, _TIFFFieldWithTag(tif, tag)->field_name);
|
|
+ v, fip ? fip->field_name : "Unknown");
|
|
} else
|
|
td->td_orientation = (uint16) v;
|
|
break;
|
|
@@ -387,11 +390,15 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
* happens, for example, when tiffcp is used to convert between
|
|
* compression schemes and codec-specific tags are blindly copied.
|
|
*/
|
|
+ /*
|
|
+ * better not dereference fip if it is NULL.
|
|
+ * -- taviso@google.com 15 Jun 2006
|
|
+ */
|
|
if(fip == NULL || fip->field_bit != FIELD_CUSTOM) {
|
|
TIFFErrorExt(tif->tif_clientdata, module,
|
|
"%s: Invalid %stag \"%s\" (not supported by codec)",
|
|
tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
|
|
- _TIFFFieldWithTag(tif, tag)->field_name);
|
|
+ fip ? fip->field_name : "Unknown");
|
|
status = 0;
|
|
break;
|
|
}
|
|
@@ -468,7 +475,7 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
if (fip->field_type == TIFF_ASCII)
|
|
_TIFFsetString((char **)&tv->value, va_arg(ap, char *));
|
|
else {
|
|
- tv->value = _TIFFmalloc(tv_size * tv->count);
|
|
+ tv->value = _TIFFCheckMalloc(tif, tv_size, tv->count, "Tag Value");
|
|
if (!tv->value) {
|
|
status = 0;
|
|
goto end;
|
|
@@ -563,7 +570,7 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
}
|
|
}
|
|
if (status) {
|
|
- TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit);
|
|
+ TIFFSetFieldBit(tif, fip->field_bit);
|
|
tif->tif_flags |= TIFF_DIRTYDIRECT;
|
|
}
|
|
|
|
@@ -572,12 +579,12 @@ end:
|
|
return (status);
|
|
badvalue:
|
|
TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %d for \"%s\"",
|
|
- tif->tif_name, v, _TIFFFieldWithTag(tif, tag)->field_name);
|
|
+ tif->tif_name, v, fip ? fip->field_name : "Unknown");
|
|
va_end(ap);
|
|
return (0);
|
|
badvalue32:
|
|
TIFFErrorExt(tif->tif_clientdata, module, "%s: Bad value %ld for \"%s\"",
|
|
- tif->tif_name, v32, _TIFFFieldWithTag(tif, tag)->field_name);
|
|
+ tif->tif_name, v32, fip ? fip->field_name : "Unknown");
|
|
va_end(ap);
|
|
return (0);
|
|
}
|
|
@@ -813,12 +820,16 @@ _TIFFVGetField(TIFF* tif, ttag_t tag, va_list ap)
|
|
* If the client tries to get a tag that is not valid
|
|
* for the image's codec then we'll arrive here.
|
|
*/
|
|
+ /*
|
|
+ * dont dereference fip if it's NULL.
|
|
+ * -- taviso@google.com 15 Jun 2006
|
|
+ */
|
|
if( fip == NULL || fip->field_bit != FIELD_CUSTOM )
|
|
{
|
|
TIFFErrorExt(tif->tif_clientdata, "_TIFFVGetField",
|
|
"%s: Invalid %stag \"%s\" (not supported by codec)",
|
|
tif->tif_name, isPseudoTag(tag) ? "pseudo-" : "",
|
|
- _TIFFFieldWithTag(tif, tag)->field_name);
|
|
+ fip ? fip->field_name : "Unknown");
|
|
ret_val = 0;
|
|
break;
|
|
}
|