diff options
| author | Lucio Andrés Illanes Albornoz <lucio@lucioillanes.de> | 2018-09-07 19:06:53 +0000 |
|---|---|---|
| committer | Lucio Andrés Illanes Albornoz <lucio@lucioillanes.de> | 2018-09-07 19:06:53 +0000 |
| commit | daac7c494df970a6e5065d53809c4e09d7b5acc9 (patch) | |
| tree | 3ad8f541477f9994a6eebeda54d024ed7c5d487c /patches/tiff/CVE-2017-17095.patch | |
| parent | 4a81a3625510ea08b4e3c175c7ae6e327e8c2d6e (diff) | |
| download | midipix_build-daac7c494df970a6e5065d53809c4e09d7b5acc9.tar.bz2 midipix_build-daac7c494df970a6e5065d53809c4e09d7b5acc9.tar.xz | |
patches/tiff/CVE-{2017-{11613,17095,9935},2018-{10963,8905}}.patch: imported from aports (via Redfoxmoon.)
Diffstat (limited to 'patches/tiff/CVE-2017-17095.patch')
| -rw-r--r-- | patches/tiff/CVE-2017-17095.patch | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/patches/tiff/CVE-2017-17095.patch b/patches/tiff/CVE-2017-17095.patch new file mode 100644 index 00000000..760c9553 --- /dev/null +++ b/patches/tiff/CVE-2017-17095.patch @@ -0,0 +1,28 @@ +Based on http://bugzilla.maptools.org/show_bug.cgi?id=2750#c5 + +diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c +index 7a57800..8443fce 100644 +--- a/tools/pal2rgb.c ++++ b/tools/pal2rgb.c +@@ -184,8 +184,19 @@ main(int argc, char* argv[]) + { unsigned char *ibuf, *obuf; + register unsigned char* pp; + register uint32 x; +- ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in)); +- obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out)); ++ tmsize_t tss_in = TIFFScanlineSize(in); ++ tmsize_t tss_out = TIFFScanlineSize(out); ++ if (tss_out / tss_in < 3) { ++ /* ++ * BUG 2750: The following code assumes the output buffer is 3x the ++ * length of the input buffer due to exploding the palette into ++ * RGB tuples. If this doesn't happen, fail now. ++ */ ++ fprintf(stderr, "Could not determine correct image size for output. Exiting.\n"); ++ return -1; ++ } ++ ibuf = (unsigned char*)_TIFFmalloc(tss_in); ++ obuf = (unsigned char*)_TIFFmalloc(tss_out); + switch (config) { + case PLANARCONFIG_CONTIG: + for (row = 0; row < imagelength; row++) { |