aboutsummaryrefslogtreecommitdiffstats
path: root/main/tiff/CVE-2012-4564.patch
blob: 9de7385cdef8c515f0dbd798203b40520f210a28 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
diff -u -r1.16 ppm2tiff.c
--- ./tools/ppm2tiff.c	10 Apr 2010 19:22:34 -0000	1.16
+++ ./tools/ppm2tiff.c	31 Oct 2012 06:25:13 -0000
@@ -89,6 +89,7 @@
 	int c;
 	extern int optind;
 	extern char* optarg;
+	size_t scanline_size;
 
 	if (argc < 2) {
 	    fprintf(stderr, "%s: Too few arguments\n", argv[0]);
@@ -237,8 +238,16 @@
 	}
 	if (TIFFScanlineSize(out) > linebytes)
 		buf = (unsigned char *)_TIFFmalloc(linebytes);
-	else
-		buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+	else {
+		scanline_size = TIFFScanlineSize(out);
+		if (scanline_size != 0)
+			buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
+		else {
+			fprintf(stderr, "%s: scanline size overflow\n",infile);
+			(void) TIFFClose(out);
+			exit(-2);					
+			}
+		}
 	if (resolution > 0) {
 		TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
 		TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);