openbsd-ports/graphics/tiff/patches/patch-libtiff_tif_dir_c
brad f81e2e0341 Fix memory allocation problems and numerous integer overflows.
CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
2004-10-20 20:37:48 +00:00

88 lines
3.3 KiB
Plaintext

$OpenBSD: patch-libtiff_tif_dir_c,v 1.1 2004/10/20 20:37:48 brad Exp $
--- libtiff/tif_dir.c.orig Fri Dec 26 06:56:25 2003
+++ libtiff/tif_dir.c Wed Oct 20 14:38:11 2004
@@ -40,26 +40,33 @@
#define DATATYPE_UINT 2 /* !unsigned integer data */
#define DATATYPE_IEEEFP 3 /* !IEEE floating point data */
-void
-_TIFFsetByteArray(void** vpp, void* vp, long n)
+static void
+setByteArray(void** vpp, void* vp, size_t nmemb, size_t elem_size)
{
if (*vpp)
_TIFFfree(*vpp), *vpp = 0;
- if (vp && (*vpp = (void*) _TIFFmalloc(n)))
- _TIFFmemcpy(*vpp, vp, n);
+ if (vp) {
+ tsize_t bytes = nmemb * elem_size;
+ if (elem_size && bytes / elem_size == nmemb)
+ *vpp = (void*) _TIFFmalloc(bytes);
+ if (*vpp)
+ _TIFFmemcpy(*vpp, vp, bytes);
+ }
}
+void _TIFFsetByteArray(void** vpp, void* vp, long n)
+ { setByteArray(vpp, vp, n, 1); }
void _TIFFsetString(char** cpp, char* cp)
- { _TIFFsetByteArray((void**) cpp, (void*) cp, (long) (strlen(cp)+1)); }
+ { setByteArray((void**) cpp, (void*) cp, strlen(cp)+1, 1); }
void _TIFFsetNString(char** cpp, char* cp, long n)
- { _TIFFsetByteArray((void**) cpp, (void*) cp, n); }
+ { setByteArray((void**) cpp, (void*) cp, n, 1); }
void _TIFFsetShortArray(uint16** wpp, uint16* wp, long n)
- { _TIFFsetByteArray((void**) wpp, (void*) wp, n*sizeof (uint16)); }
+ { setByteArray((void**) wpp, (void*) wp, n, sizeof (uint16)); }
void _TIFFsetLongArray(uint32** lpp, uint32* lp, long n)
- { _TIFFsetByteArray((void**) lpp, (void*) lp, n*sizeof (uint32)); }
+ { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint32)); }
void _TIFFsetFloatArray(float** fpp, float* fp, long n)
- { _TIFFsetByteArray((void**) fpp, (void*) fp, n*sizeof (float)); }
+ { setByteArray((void**) fpp, (void*) fp, n, sizeof (float)); }
void _TIFFsetDoubleArray(double** dpp, double* dp, long n)
- { _TIFFsetByteArray((void**) dpp, (void*) dp, n*sizeof (double)); }
+ { setByteArray((void**) dpp, (void*) dp, n, sizeof (double)); }
/*
* Install extra samples information.
@@ -521,15 +528,22 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
*/
if( tv == NULL )
{
- td->td_customValueCount++;
- if( td->td_customValueCount > 1 )
- td->td_customValues = (TIFFTagValue *)
- _TIFFrealloc(td->td_customValues,
- sizeof(TIFFTagValue) * td->td_customValueCount);
- else
- td->td_customValues = (TIFFTagValue *)
- _TIFFmalloc(sizeof(TIFFTagValue));
+ TIFFTagValue *new_customValues;
+
+ td->td_customValueCount++;
+ new_customValues = (TIFFTagValue *)
+ _TIFFrealloc(td->td_customValues,
+ sizeof(TIFFTagValue) * td->td_customValueCount);
+ if (!new_customValues) {
+ TIFFError(module,
+ "%s: Failed to allocate space for list of custom values",
+ tif->tif_name);
+ status = 0;
+ goto end;
+ }
+ td->td_customValues = new_customValues;
+
tv = td->td_customValues + (td->td_customValueCount-1);
tv->info = fip;
tv->value = NULL;
@@ -584,6 +598,8 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit);
tif->tif_flags |= TIFF_DIRTYDIRECT;
}
+
+end:
va_end(ap);
return (status);
badvalue: