Bugzilla – Attachment 36586 Details for
Bug 82787
VUL-0: CVE-2005-1544: libtiff buffer overflow
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
current patch from CVS
tiff-v3.7.1-BitsPerSample.patch (text/plain), 2.22 KB, created by
Vladimir Nadvornik
on 2005-05-09 09:45:03 UTC
(
hide
)
Description:
current patch from CVS
Filename:
MIME Type:
Creator:
Vladimir Nadvornik
Created:
2005-05-09 09:45:03 UTC
Size:
2.22 KB
patch
obsolete
>diff -u -w -r1.51 -r1.53 >--- libtiff/tif_dirread.c 3 Mar 2005 16:00:01 -0000 1.51 >+++ libtiff/tif_dirread.c 6 May 2005 14:35:50 -0000 1.53 >@@ -1310,12 +1310,16 @@ > uint16 buf[10]; > uint16* v = buf; > >- if (samples > NITEMS(buf)) >- v = (uint16*) CheckMalloc(tif, samples, sizeof(uint16), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (uint16*) CheckMalloc(tif, dir->tdir_count, sizeof(uint16), > "to fetch per-sample values"); > if (v && TIFFFetchShortArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ if( samples < check_count ) >+ check_count = samples; >+ >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"", >@@ -1347,12 +1351,16 @@ > uint32 buf[10]; > uint32* v = buf; > >- if (samples > NITEMS(buf)) >- v = (uint32*) CheckMalloc(tif, samples, sizeof(uint32), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (uint32*) CheckMalloc(tif, dir->tdir_count, sizeof(uint32), > "to fetch per-sample values"); > if (v && TIFFFetchLongArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ >+ if( samples < check_count ) >+ check_count = samples; >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"", >@@ -1384,12 +1392,16 @@ > double buf[10]; > double* v = buf; > >- if (samples > NITEMS(buf)) >- v = (double*) CheckMalloc(tif, samples, sizeof (double), >+ if (dir->tdir_count > NITEMS(buf)) >+ v = (double*) CheckMalloc(tif, dir->tdir_count, sizeof (double), > "to fetch per-sample values"); > if (v && TIFFFetchAnyArray(tif, dir, v)) { > uint16 i; >- for (i = 1; i < samples; i++) >+ int check_count = dir->tdir_count; >+ if( samples < check_count ) >+ check_count = samples; >+ >+ for (i = 1; i < check_count; i++) > if (v[i] != v[0]) { > TIFFError(tif->tif_name, > "Cannot handle different per-sample values for field \"%s\"",
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 82787
: 36586