libs/tiff/patches/108-CVE.patch

   1 commit a1d523c27dafafadf589c77e834c52661f1c78fc
   2 Author: erouault <erouault>
   3 Date:   Sat Dec 3 14:18:48 2016 +0000
   4
   5     * tools/tiffinfo.c: fix null pointer dereference in -r mode when the image has
   6     no StripByteCount tag.
   7     Reported by Agostino Sarubbo.
   8     Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2594
   9
  10 diff --git a/ChangeLog b/ChangeLog
  11 index dd27c7f..e41d00c 100644
  12 --- a/ChangeLog
  13 +++ b/ChangeLog
  14 @@ -1,5 +1,12 @@
  15  2016-12-03 Even Rouault <even.rouault at spatialys.com>
  16
  17 +       * tools/tiffinfo.c: fix null pointer dereference in -r mode when the image has
  18 +       no StripByteCount tag.
  19 +       Reported by Agostino Sarubbo.
  20 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2594
  21 +
  22 +2016-12-03 Even Rouault <even.rouault at spatialys.com>
  23 +
  24         * tools/tiffcrop.c: fix integer division by zero when BitsPerSample is missing.
  25         Reported by Agostino Sarubbo.
  26         Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619
  27 diff --git a/tools/tiffinfo.c b/tools/tiffinfo.c
  28 index b02c7d4..4d58055 100644
  29 --- a/tools/tiffinfo.c
  30 +++ b/tools/tiffinfo.c
  31 @@ -1,4 +1,4 @@
  32 -/* $Id: tiffinfo.c,v 1.25 2016-11-12 20:06:05 bfriesen Exp $ */
  33 +/* $Id: tiffinfo.c,v 1.26 2016-12-03 14:18:49 erouault Exp $ */
  34
  35  /*
  36   * Copyright (c) 1988-1997 Sam Leffler
  37 @@ -417,7 +417,7 @@ TIFFReadRawData(TIFF* tif, int bitrev)
  38         uint64* stripbc=NULL;
  39
  40         TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &stripbc);
  41 -       if (nstrips > 0) {
  42 +       if (stripbc != NULL && nstrips > 0) {
  43                 uint32 bufsize = (uint32) stripbc[0];
  44                 tdata_t buf = _TIFFmalloc(bufsize);
  45                 tstrip_t s;