summary refs log tree commit diff
path: root/gnu/packages/patches/libtiff-divide-by-zero-tiffcrop.patch
blob: 823293f1cf476ef374550b124f677212d8fde616 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
Fix divide-by-zero in readSeparateStripsIntoBuffer():

http://bugzilla.maptools.org/show_bug.cgi?id=2619

2016-12-03 Even Rouault <even.rouault at spatialys.com>

        * tools/tiffcrop.c: fix integer division by zero when BitsPerSample is
missing.
        Reported by Agostina Sarubo.
        Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2619

/cvs/maptools/cvsroot/libtiff/ChangeLog,v  <--  ChangeLog
new revision: 1.1180; previous revision: 1.1179
/cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v  <--  tools/tiffcrop.c
new revision: 1.49; previous revision: 1.48

Index: libtiff/tools/tiffcrop.c
===================================================================
RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v
retrieving revision 1.48
retrieving revision 1.49
diff -u -r1.48 -r1.49
--- libtiff/tools/tiffcrop.c	3 Dec 2016 12:19:32 -0000	1.48
+++ libtiff/tools/tiffcrop.c	3 Dec 2016 13:00:04 -0000	1.49
@@ -1,4 +1,4 @@
-/* $Id: tiffcrop.c,v 1.48 2016-12-03 12:19:32 erouault Exp $ */
+/* $Id: tiffcrop.c,v 1.49 2016-12-03 13:00:04 erouault Exp $ */
 
 /* tiffcrop.c -- a port of tiffcp.c extended to include manipulations of
  * the image data through additional options listed below
@@ -1164,7 +1164,7 @@
   tdata_t  obuf;
 
   (void) TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
-  (void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
+  (void) TIFFGetFieldDefaulted(out, TIFFTAG_BITSPERSAMPLE, &bps);
   bytes_per_sample = (bps + 7) / 8;
   if( width == 0 ||
       (uint32)bps * (uint32)spp > TIFF_UINT32_MAX / width ||
@@ -4760,7 +4760,7 @@
   int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
   uint32 j;
   int32  bytes_read = 0;
-  uint16 bps, planar;
+  uint16 bps = 0, planar;
   uint32 nstrips;
   uint32 strips_per_sample;
   uint32 src_rowsize, dst_rowsize, rows_processed, rps;
@@ -4780,7 +4780,7 @@
     }
 
   memset (srcbuffs, '\0', sizeof(srcbuffs));
-  TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bps);
+  TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);
   TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &planar);
   TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
   if (rps > length)