openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_dirinfo_c
brad f81e2e0341 Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
2004-10-20 20:37:48 +00:00

60 lines
1.8 KiB
Plaintext

$OpenBSD: patch-libtiff_tif_dirinfo_c,v 1.1 2004/10/20 20:37:48 brad Exp $
--- libtiff/tif_dirinfo.c.orig Mon Dec 22 03:22:15 2003
+++ libtiff/tif_dirinfo.c Wed Oct 20 14:38:11 2004
@@ -31,6 +31,8 @@
*/
#include "tiffiop.h"
#include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
/*
* NB: NB: THIS ARRAY IS ASSUMED TO BE SORTED BY TAG.
@@ -309,6 +311,7 @@ _TIFFMergeFieldInfo(TIFF* tif, const TIF
tif->tif_fieldinfo = (TIFFFieldInfo**)
_TIFFmalloc(n * sizeof (TIFFFieldInfo*));
}
+ assert(tif->tif_fieldinfo != NULL);
tp = &tif->tif_fieldinfo[tif->tif_nfields];
for (i = 0; i < n; i++)
tp[i] = (TIFFFieldInfo*) &info[i]; /* XXX */
@@ -376,7 +379,7 @@ TIFFDataWidth(TIFFDataType type)
TIFFDataType
_TIFFSampleToTagType(TIFF* tif)
{
- int bps = (int) TIFFhowmany(tif->tif_dir.td_bitspersample, 8);
+ uint32 bps = TIFFhowmany8(tif->tif_dir.td_bitspersample);
switch (tif->tif_dir.td_sampleformat) {
case SAMPLEFORMAT_IEEEFP:
@@ -422,9 +425,6 @@ _TIFFFindFieldInfo(TIFF* tif, ttag_t tag
return ((const TIFFFieldInfo *)0);
}
-#include <assert.h>
-#include <stdio.h>
-
const TIFFFieldInfo*
_TIFFFieldWithTag(TIFF* tif, ttag_t tag)
{
@@ -460,6 +460,8 @@ _TIFFCreateAnonFieldInfo(TIFF *tif, ttag
TIFFFieldInfo *fld;
fld = (TIFFFieldInfo *) _TIFFmalloc(sizeof (TIFFFieldInfo));
+ if (fld == NULL)
+ return NULL;
_TIFFmemset( fld, 0, sizeof(TIFFFieldInfo) );
fld->field_tag = tag;
@@ -470,6 +472,10 @@ _TIFFCreateAnonFieldInfo(TIFF *tif, ttag
fld->field_oktochange = TRUE;
fld->field_passcount = TRUE;
fld->field_name = (char *) _TIFFmalloc(32);
+ if (fld->field_name == NULL) {
+ _TIFFfree(fld);
+ return NULL;
+ }
/* note that this name is a special sign to TIFFClose() and
* _TIFFSetupFieldInfo() to free the field