You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

51 lines
1.7 KiB

  1. From 2ea32f7372b65c24b2816f11c04bf59b5090d05b Mon Sep 17 00:00:00 2001
  2. From: erouault <erouault>
  3. Date: Thu, 12 Jan 2017 19:23:20 +0000
  4. Subject: [PATCH] * libtiff/tif_ojpeg.c: fix leak in
  5. OJPEGReadHeaderInfoSecTablesQTable, OJPEGReadHeaderInfoSecTablesDcTable and
  6. OJPEGReadHeaderInfoSecTablesAcTable
  7. ---
  8. ChangeLog | 3 ++-
  9. libtiff/tif_ojpeg.c | 6 ++++++
  10. 2 files changed, 8 insertions(+), 1 deletion(-)
  11. diff --git a/ChangeLog b/ChangeLog
  12. index 12e0370..cd2fa17 100644
  13. --- a/ChangeLog
  14. +++ b/ChangeLog
  15. @@ -1,6 +1,7 @@
  16. 2017-01-12 Even Rouault <even.rouault at spatialys.com>
  17. - * libtiff/tif_ojpeg.c: fix leak in OJPEGReadHeaderInfoSecTablesAcTable
  18. + * libtiff/tif_ojpeg.c: fix leak in OJPEGReadHeaderInfoSecTablesQTable,
  19. + OJPEGReadHeaderInfoSecTablesDcTable and OJPEGReadHeaderInfoSecTablesAcTable
  20. when read fails.
  21. Patch by Nicolás Peña.
  22. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2659
  23. diff --git a/libtiff/tif_ojpeg.c b/libtiff/tif_ojpeg.c
  24. index b92f0eb..5f6c684 100644
  25. --- a/libtiff/tif_ojpeg.c
  26. +++ b/libtiff/tif_ojpeg.c
  27. @@ -1790,7 +1790,10 @@ OJPEGReadHeaderInfoSecTablesQTable(TIFF* tif)
  28. TIFFSeekFile(tif,sp->qtable_offset[m],SEEK_SET);
  29. p=(uint32)TIFFReadFile(tif,&ob[sizeof(uint32)+5],64);
  30. if (p!=64)
  31. + {
  32. + _TIFFfree(ob);
  33. return(0);
  34. + }
  35. sp->qtable[m]=ob;
  36. sp->sof_tq[m]=m;
  37. }
  38. @@ -1854,7 +1857,10 @@ OJPEGReadHeaderInfoSecTablesDcTable(TIFF* tif)
  39. rb[sizeof(uint32)+5+n]=o[n];
  40. p=(uint32)TIFFReadFile(tif,&(rb[sizeof(uint32)+21]),q);
  41. if (p!=q)
  42. + {
  43. + _TIFFfree(rb);
  44. return(0);
  45. + }
  46. sp->dctable[m]=rb;
  47. sp->sos_tda[m]=(m<<4);
  48. }