blob: 2afca18e1d07370551b555f4e7365e03f1bd383b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
Fix CVE-2016-5321.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558
Patch extracted from upstream CVS repo with:
$ cvs diff -u -r1.35 -r1.36 tools/tiffcrop.c
Index: tools/tiffcrop.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v
retrieving revision 1.35
retrieving revision 1.36
diff -u -r1.35 -r1.36
--- libtiff/tools/tiffcrop.c 19 Aug 2015 02:31:04 -0000 1.35
+++ libtiff/tools/tiffcrop.c 11 Jul 2016 21:26:03 -0000 1.36
@@ -989,7 +989,7 @@
nrow = (row + tl > imagelength) ? imagelength - row : tl;
for (col = 0; col < imagewidth; col += tw)
{
- for (s = 0; s < spp; s++)
+ for (s = 0; s < spp && s < MAX_SAMPLES; s++)
{ /* Read each plane of a tile set into srcbuffs[s] */
tbytes = TIFFReadTile(in, srcbuffs[s], col, row, 0, s);
if (tbytes < 0 && !ignore)
|
