diff options
Diffstat (limited to 'libs/tiff/patches/107-CVE.patch')
-rw-r--r-- | libs/tiff/patches/107-CVE.patch | 61 |
1 files changed, 0 insertions, 61 deletions
diff --git a/libs/tiff/patches/107-CVE.patch b/libs/tiff/patches/107-CVE.patch deleted file mode 100644 index c588ec3e5..000000000 --- a/libs/tiff/patches/107-CVE.patch +++ /dev/null @@ -1,61 +0,0 @@ -commit fc9eedf265394eb8a5633160a8fcdb7ece072701 -Author: erouault <erouault> -Date: Sat Dec 3 13:00:03 2016 +0000 - - * tools/tiffcrop.c: fix integer division by zero when BitsPerSample is missing. - Reported by Agostino Sarubbo. - Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619 - -diff --git a/ChangeLog b/ChangeLog -index 50db803..2940828 100644 ---- a/ChangeLog -+++ b/ChangeLog -@@ -1,5 +1,11 @@ - 2016-12-03 Even Rouault <even.rouault at spatialys.com> - -+ * tools/tiffcrop.c: fix integer division by zero when BitsPerSample is missing. -+ Reported by Agostino Sarubbo. -+ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619 -+ -+2016-12-03 Even Rouault <even.rouault at spatialys.com> -+ - * tools/tiffcrop.c: add 3 extra bytes at end of strip buffer in - readSeparateStripsIntoBuffer() to avoid read outside of heap allocated buffer. - Reported by Agostino Sarubbo. -diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c -index 9122aab..21dd087 100644 ---- a/tools/tiffcrop.c -+++ b/tools/tiffcrop.c -@@ -1,4 +1,4 @@ --/* $Id: tiffcrop.c,v 1.48 2016-12-03 12:19:32 erouault Exp $ */ -+/* $Id: tiffcrop.c,v 1.49 2016-12-03 13:00:04 erouault Exp $ */ - - /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of - * the image data through additional options listed below -@@ -1164,7 +1164,7 @@ writeBufferToSeparateStrips (TIFF* out, uint8* buf, - tdata_t obuf; - - (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip); -- (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps); -+ (void) TIFFGetFieldDefaulted(out, TIFFTAG_BITSPERSAMPLE, &bps); - bytes_per_sample = (bps + 7) / 8; - if( width == 0 || - (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / width || -@@ -4760,7 +4760,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length, - int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1; - uint32 j; - int32 bytes_read = 0; -- uint16 bps, planar; -+ uint16 bps = 0, planar; - uint32 nstrips; - uint32 strips_per_sample; - uint32 src_rowsize, dst_rowsize, rows_processed, rps; -@@ -4780,7 +4780,7 @@ static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length, - } - - memset (srcbuffs, '\0', sizeof(srcbuffs)); -- TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps); -+ TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps); - TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &planar); - TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps); - if (rps > length) |