libs/tiff/patches/115-CVE-2016-10094.patch

   1 From c7153361a4041260719b340f73f2f76b0969235c Mon Sep 17 00:00:00 2001
   2 From: erouault <erouault>
   3 Date: Tue, 20 Dec 2016 17:28:17 +0000
   4 Subject: [PATCH] * tools/tiff2pdf.c: avoid potential heap-based overflow in
   5  t2p_readwrite_pdf_image_tile(). Fixes
   6  http://bugzilla.maptools.org/show_bug.cgi?id=2640
   7
   8 ---
   9  ChangeLog        | 6 ++++++
  10  tools/tiff2pdf.c | 2 +-
  11  2 files changed, 7 insertions(+), 1 deletion(-)
  12
  13 diff --git a/ChangeLog b/ChangeLog
  14 index 6be3602..91ba4e6 100644
  15 --- a/ChangeLog
  16 +++ b/ChangeLog
  17 @@ -1,3 +1,9 @@
  18 +2016-12-20 Even Rouault <even.rouault at spatialys.com>
  19 +
  20 +       * tools/tiff2pdf.c: avoid potential heap-based overflow in
  21 +       t2p_readwrite_pdf_image_tile().
  22 +       Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2640
  23 +
  24  2016-12-13 Even Rouault <even.rouault at spatialys.com>
  25
  26         * libtiff/tif_fax3.h: revert change done on 2016-01-09 that made
  27 diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
  28 index 47d7629..db196e0 100644
  29 --- a/tools/tiff2pdf.c
  30 +++ b/tools/tiff2pdf.c
  31 @@ -2895,7 +2895,7 @@ tsize_t t2p_readwrite_pdf_image_tile(T2P
  32                                 return(0);
  33                         }
  34                         if(TIFFGetField(input, TIFFTAG_JPEGTABLES, &count, &jpt) != 0) {
  35 -                               if (count >= 4) {
  36 +                               if (count > 4) {
  37                      /* Ignore EOI marker of JpegTables */
  38                                         _TIFFmemcpy(buffer, jpt, count - 2);
  39                                         bufferoffset += count - 2;