diff -Naurp tiff-3.9.5/ChangeLog tiff-3.9.5.oden/ChangeLog --- tiff-3.9.5/ChangeLog 2011-04-09 20:00:13.000000000 +0000 +++ tiff-3.9.5.oden/ChangeLog 2012-03-30 17:26:24.000000000 +0000 @@ -1,3 +1,9 @@ +2012-03-30 Frank Warmerdam <warmerdam@google.com> + + * tif_getimage.c: Fix size overflow (zdi-can-1221,CVE-2012-1173) + care of Tom Lane @ Red Hat. + + 2011-04-09 Bob Friesenhahn <bfriesen@simple.dallas.tx.us> * libtiff 3.9.5 released. diff -Naurp tiff-3.9.5/libtiff/tif_getimage.c tiff-3.9.5.oden/libtiff/tif_getimage.c --- tiff-3.9.5/libtiff/tif_getimage.c 2010-07-08 16:17:59.000000000 +0000 +++ tiff-3.9.5.oden/libtiff/tif_getimage.c 2012-03-30 17:26:24.000000000 +0000 @@ -673,18 +673,24 @@ gtTileSeparate(TIFFRGBAImage* img, uint3 unsigned char* p2; unsigned char* pa; tsize_t tilesize; + tsize_t bufsize; int32 fromskew, toskew; int alpha = img->alpha; uint32 nrow; int ret = 1, flip; tilesize = TIFFTileSize(tif); - buf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize); + bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,tilesize); + if (bufsize == 0) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate"); + return (0); + } + buf = (unsigned char*) _TIFFmalloc(bufsize); if (buf == 0) { TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); return (0); } - _TIFFmemset(buf, 0, (alpha?4:3)*tilesize); + _TIFFmemset(buf, 0, bufsize); p0 = buf; p1 = p0 + tilesize; p2 = p1 + tilesize; @@ -880,17 +886,23 @@ gtStripSeparate(TIFFRGBAImage* img, uint uint32 rowsperstrip, offset_row; uint32 imagewidth = img->width; tsize_t stripsize; + tsize_t bufsize; int32 fromskew, toskew; int alpha = img->alpha; int ret = 1, flip; stripsize = TIFFStripSize(tif); - p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize); + bufsize = TIFFSafeMultiply(tsize_t,alpha?4:3,stripsize); + if (bufsize == 0) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtStripSeparate"); + return (0); + } + p0 = buf = (unsigned char *)_TIFFmalloc(bufsize); if (buf == 0) { TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for tile buffer"); return (0); } - _TIFFmemset(buf, 0, (alpha?4:3)*stripsize); + _TIFFmemset(buf, 0, bufsize); p1 = p0 + stripsize; p2 = p1 + stripsize; pa = (alpha?(p2+stripsize):NULL); diff -Naurp tiff-3.9.5/libtiff/tiffiop.h tiff-3.9.5.oden/libtiff/tiffiop.h --- tiff-3.9.5/libtiff/tiffiop.h 2011-03-28 13:43:43.000000000 +0000 +++ tiff-3.9.5.oden/libtiff/tiffiop.h 2012-03-30 17:26:24.000000000 +0000 @@ -246,7 +246,7 @@ struct tiff { #define TIFFroundup(x, y) (TIFFhowmany(x,y)*(y)) /* Safe multiply which returns zero if there is an integer overflow */ -#define TIFFSafeMultiply(t,v,m) ((((t)m != (t)0) && (((t)((v*m)/m)) == (t)v)) ? (t)(v*m) : (t)0) +#define TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) #define TIFFmax(A,B) ((A)>(B)?(A):(B)) #define TIFFmin(A,B) ((A)<(B)?(A):(B))