- fixed buffer overflow in libtiff/tif_dirread.c

Changed files:
    libtiff-crash.patch -> 1.1

diff --git a/libtiff-crash.patch b/libtiff-crash.patch
new file mode 100644 (file)
index 0000000..9803cfb
--- /dev/null
+++ b/libtiff-crash.patch
@@ -0,0 +1,201 @@
+diff -urN tiff-3.7.2.orig/libtiff/tif_dirread.c tiff-3.7.2/libtiff/tif_dirread.c
+--- tiff-3.7.2.orig/libtiff/tif_dirread.c      2005-05-16 09:55:17.000000000 +0000
++++ tiff-3.7.2/libtiff/tif_dirread.c   2005-05-16 09:56:23.000000000 +0000
+@@ -1,4 +1,4 @@
+-/* $Id$ */
++/* $Id$ */
+ 
+ /*
+  * Copyright (c) 1988-1997 Sam Leffler
+@@ -1303,33 +1303,37 @@
+ static int
+ TIFFFetchPerSampleShorts(TIFF* tif, TIFFDirEntry* dir, uint16* pl)
+ {
+-      uint16 samples = tif->tif_dir.td_samplesperpixel;
+-      int status = 0;
++    uint16 samples = tif->tif_dir.td_samplesperpixel;
++    int status = 0;
+ 
+-      if (CheckDirCount(tif, dir, (uint32) samples)) {
+-              uint16 buf[10];
+-              uint16* v = buf;
+-
+-              if (samples > NITEMS(buf))
+-                      v = (uint16*) CheckMalloc(tif, samples, sizeof(uint16),
+-                                                "to fetch per-sample values");
+-              if (v && TIFFFetchShortArray(tif, dir, v)) {
+-                      uint16 i;
+-                      for (i = 1; i < samples; i++)
+-                              if (v[i] != v[0]) {
+-                                      TIFFError(tif->tif_name,
+-              "Cannot handle different per-sample values for field \"%s\"",
+-                         _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
+-                                      goto bad;
+-                              }
+-                      *pl = v[0];
+-                      status = 1;
+-              }
+-      bad:
+-              if (v && v != buf)
+-                      _TIFFfree(v);
+-      }
+-      return (status);
++    if (CheckDirCount(tif, dir, (uint32) samples)) {
++        uint16 buf[10];
++        uint16* v = buf;
++
++        if (dir->tdir_count > NITEMS(buf))
++            v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof(uint16),
++                                      "to fetch per-sample values");
++        if (v && TIFFFetchShortArray(tif, dir, v)) {
++            uint16 i;
++            int check_count = dir->tdir_count;
++            if( samples < check_count )
++                check_count = samples;
++
++            for (i = 1; i < check_count; i++)
++                if (v[i] != v[0]) {
++                    TIFFError(tif->tif_name,
++                              "Cannot handle different per-sample values for field \"%s\"",
++                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
++                    goto bad;
++                }
++            *pl = v[0];
++            status = 1;
++        }
++      bad:
++        if (v && v != buf)
++            _TIFFfree(v);
++    }
++    return (status);
+ }
+ 
+ /*
+@@ -1340,33 +1344,37 @@
+ static int
+ TIFFFetchPerSampleLongs(TIFF* tif, TIFFDirEntry* dir, uint32* pl)
+ {
+-      uint16 samples = tif->tif_dir.td_samplesperpixel;
+-      int status = 0;
++    uint16 samples = tif->tif_dir.td_samplesperpixel;
++    int status = 0;
+ 
+-      if (CheckDirCount(tif, dir, (uint32) samples)) {
+-              uint32 buf[10];
+-              uint32* v = buf;
+-
+-              if (samples > NITEMS(buf))
+-                      v = (uint32*) CheckMalloc(tif, samples, sizeof(uint32),
+-                                                "to fetch per-sample values");
+-              if (v && TIFFFetchLongArray(tif, dir, v)) {
+-                      uint16 i;
+-                      for (i = 1; i < samples; i++)
+-                              if (v[i] != v[0]) {
+-                                      TIFFError(tif->tif_name,
+-              "Cannot handle different per-sample values for field \"%s\"",
+-                         _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
+-                                      goto bad;
+-                              }
+-                      *pl = v[0];
+-                      status = 1;
+-              }
+-      bad:
+-              if (v && v != buf)
+-                      _TIFFfree(v);
+-      }
+-      return (status);
++    if (CheckDirCount(tif, dir, (uint32) samples)) {
++        uint32 buf[10];
++        uint32* v = buf;
++
++        if (dir->tdir_count > NITEMS(buf))
++            v = (uint32*) CheckMalloc(tif, dir->tdir_count, sizeof(uint32),
++                                      "to fetch per-sample values");
++        if (v && TIFFFetchLongArray(tif, dir, v)) {
++            uint16 i;
++            int check_count = dir->tdir_count;
++
++            if( samples < check_count )
++                check_count = samples;
++            for (i = 1; i < check_count; i++)
++                if (v[i] != v[0]) {
++                    TIFFError(tif->tif_name,
++                              "Cannot handle different per-sample values for field \"%s\"",
++                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
++                    goto bad;
++                }
++            *pl = v[0];
++            status = 1;
++        }
++      bad:
++        if (v && v != buf)
++            _TIFFfree(v);
++    }
++    return (status);
+ }
+ 
+ /*
+@@ -1377,33 +1385,37 @@
+ static int
+ TIFFFetchPerSampleAnys(TIFF* tif, TIFFDirEntry* dir, double* pl)
+ {
+-      uint16 samples = tif->tif_dir.td_samplesperpixel;
+-      int status = 0;
++    uint16 samples = tif->tif_dir.td_samplesperpixel;
++    int status = 0;
+ 
+-      if (CheckDirCount(tif, dir, (uint32) samples)) {
+-              double buf[10];
+-              double* v = buf;
+-
+-              if (samples > NITEMS(buf))
+-                      v = (double*) CheckMalloc(tif, samples, sizeof (double),
+-                                                "to fetch per-sample values");
+-              if (v && TIFFFetchAnyArray(tif, dir, v)) {
+-                      uint16 i;
+-                      for (i = 1; i < samples; i++)
+-                              if (v[i] != v[0]) {
+-                                      TIFFError(tif->tif_name,
+-              "Cannot handle different per-sample values for field \"%s\"",
+-                         _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
+-                                      goto bad;
+-                              }
+-                      *pl = v[0];
+-                      status = 1;
+-              }
+-      bad:
+-              if (v && v != buf)
+-                      _TIFFfree(v);
+-      }
+-      return (status);
++    if (CheckDirCount(tif, dir, (uint32) samples)) {
++        double buf[10];
++        double* v = buf;
++
++        if (dir->tdir_count > NITEMS(buf))
++            v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double),
++                                      "to fetch per-sample values");
++        if (v && TIFFFetchAnyArray(tif, dir, v)) {
++            uint16 i;
++            int check_count = dir->tdir_count;
++            if( samples < check_count )
++                check_count = samples;
++
++            for (i = 1; i < check_count; i++)
++                if (v[i] != v[0]) {
++                    TIFFError(tif->tif_name,
++                              "Cannot handle different per-sample values for field \"%s\"",
++                              _TIFFFieldWithTag(tif, dir->tdir_tag)->field_name);
++                    goto bad;
++                }
++            *pl = v[0];
++            status = 1;
++        }
++      bad:
++        if (v && v != buf)
++            _TIFFfree(v);
++    }
++    return (status);
+ }
+ #undef NITEMS
+