openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_strip_c
brad f81e2e0341 Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
2004-10-20 20:37:48 +00:00

107 lines
3.4 KiB
Plaintext

$OpenBSD: patch-libtiff_tif_strip_c,v 1.1 2004/10/20 20:37:48 brad Exp $
--- libtiff/tif_strip.c.orig Tue Nov 11 10:43:10 2003
+++ libtiff/tif_strip.c Wed Oct 20 14:38:11 2004
@@ -31,6 +31,32 @@
*/
#include "tiffiop.h"
+static uint32
+summarize(TIFF* tif, size_t summand1, size_t summand2, const char* where)
+{
+ uint32 bytes = summand1 + summand2;
+
+ if (bytes - summand1 != summand2) {
+ TIFFError(tif->tif_name, "Integer overflow in %s", where);
+ bytes = 0;
+ }
+
+ return (bytes);
+}
+
+static uint32
+multiply(TIFF* tif, size_t nmemb, size_t elem_size, const char* where)
+{
+ uint32 bytes = nmemb * elem_size;
+
+ if (elem_size && bytes / elem_size != nmemb) {
+ TIFFError(tif->tif_name, "Integer overflow in %s", where);
+ bytes = 0;
+ }
+
+ return (bytes);
+}
+
/*
* Compute which strip a (row,sample) value is in.
*/
@@ -66,7 +92,8 @@ TIFFNumberOfStrips(TIFF* tif)
(td->td_imagelength != 0 ? 1 : 0) :
TIFFhowmany(td->td_imagelength, td->td_rowsperstrip));
if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
- nstrips *= td->td_samplesperpixel;
+ nstrips = multiply(tif, nstrips, td->td_samplesperpixel,
+ "TIFFNumberOfStrips");
return (nstrips);
}
@@ -100,15 +127,20 @@ TIFFVStripSize(TIFF* tif, uint32 nrows)
ycbcrsubsampling + 1 );
w = TIFFroundup(td->td_imagewidth, ycbcrsubsampling[0]);
- scanline = TIFFhowmany(w*td->td_bitspersample, 8);
+ scanline = TIFFhowmany8(multiply(tif, w, td->td_bitspersample,
+ "TIFFVStripSize"));
samplingarea = ycbcrsubsampling[0]*ycbcrsubsampling[1];
nrows = TIFFroundup(nrows, ycbcrsubsampling[1]);
/* NB: don't need TIFFhowmany here 'cuz everything is rounded */
+ scanline = multiply(tif, nrows, scanline, "TIFFVStripSize");
return ((tsize_t)
- (nrows*scanline + 2*(nrows*scanline / samplingarea)));
+ summarize(tif, scanline,
+ multiply(tif, 2, scanline / samplingarea,
+ "TIFFVStripSize"), "TIFFVStripSize"));
} else
#endif
- return ((tsize_t)(nrows * TIFFScanlineSize(tif)));
+ return ((tsize_t) multiply(tif, nrows, TIFFScanlineSize(tif),
+ "TIFFVStripSize"));
}
@@ -189,10 +221,12 @@ TIFFScanlineSize(TIFF* tif)
TIFFDirectory *td = &tif->tif_dir;
tsize_t scanline;
- scanline = td->td_bitspersample * td->td_imagewidth;
+ scanline = multiply (tif, td->td_bitspersample, td->td_imagewidth,
+ "TIFFScanlineSize");
if (td->td_planarconfig == PLANARCONFIG_CONTIG)
- scanline *= td->td_samplesperpixel;
- return ((tsize_t) TIFFhowmany(scanline, 8));
+ scanline = multiply (tif, scanline, td->td_samplesperpixel,
+ "TIFFScanlineSize");
+ return ((tsize_t) TIFFhowmany8(scanline));
}
/*
@@ -207,11 +241,14 @@ TIFFRasterScanlineSize(TIFF* tif)
TIFFDirectory *td = &tif->tif_dir;
tsize_t scanline;
- scanline = td->td_bitspersample * td->td_imagewidth;
+ scanline = multiply (tif, td->td_bitspersample, td->td_imagewidth,
+ "TIFFRasterScanlineSize");
if (td->td_planarconfig == PLANARCONFIG_CONTIG) {
- scanline *= td->td_samplesperpixel;
- return ((tsize_t) TIFFhowmany(scanline, 8));
+ scanline = multiply (tif, scanline, td->td_samplesperpixel,
+ "TIFFRasterScanlineSize");
+ return ((tsize_t) TIFFhowmany8(scanline));
} else
- return ((tsize_t)
- TIFFhowmany(scanline, 8)*td->td_samplesperpixel);
+ return ((tsize_t) multiply (tif, TIFFhowmany8(scanline),
+ td->td_samplesperpixel,
+ "TIFFRasterScanlineSize"));
}