diff options
| author | Aaron Boxer <boxerab@gmail.com> | 2014-12-09 14:33:38 -0500 |
|---|---|---|
| committer | Antonin Descampe <antonin@gmail.com> | 2015-07-03 19:19:17 +0200 |
| commit | 6b0a8e3a0fc0dd18b01a8810b6867d6da8fa79e4 (patch) | |
| tree | 4e34a268505357dad2498cf97580e72948cc4c1a /thirdparty/libtiff/tif_packbits.c | |
| parent | eadfad7a5014e0bf2a56667194af976fc9fc987c (diff) | |
upgraded to libtiff v4.0.4
Diffstat (limited to 'thirdparty/libtiff/tif_packbits.c')
| -rw-r--r-- | thirdparty/libtiff/tif_packbits.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/thirdparty/libtiff/tif_packbits.c b/thirdparty/libtiff/tif_packbits.c index a79abe86..9e771901 100644 --- a/thirdparty/libtiff/tif_packbits.c +++ b/thirdparty/libtiff/tif_packbits.c @@ -1,4 +1,4 @@ -/* $Id: tif_packbits.c,v 1.20 2010-03-10 18:56:49 bfriesen Exp $ */ +/* $Id: tif_packbits.c,v 1.22 2012-06-20 05:25:33 fwarmerdam Exp $ */ /* * Copyright (c) 1988-1997 Sam Leffler @@ -241,7 +241,7 @@ PackBitsDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s) n = (long)occ; } occ -= n; - b = *bp++, cc--; /* TODO: may be reading past input buffer here when input data is corrupt or ends prematurely */ + b = *bp++, cc--; while (n-- > 0) *op++ = (uint8) b; } else { /* copy next n+1 bytes literally */ @@ -252,7 +252,13 @@ PackBitsDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s) (unsigned long) ((tmsize_t)n - occ + 1)); n = (long)occ - 1; } - _TIFFmemcpy(op, bp, ++n); /* TODO: may be reading past input buffer here when input data is corrupt or ends prematurely */ + if (cc < (tmsize_t) (n+1)) + { + TIFFWarningExt(tif->tif_clientdata, module, + "Terminating PackBitsDecode due to lack of data."); + break; + } + _TIFFmemcpy(op, bp, ++n); op += n; occ -= n; bp += n; cc -= n; } |