|
|
- From 1c127eb3cb7653bd61b61f9c3cfeb36fd10edab1 Mon Sep 17 00:00:00 2001
- From: Even Rouault <even.rouault@spatialys.com>
- Date: Sat, 12 May 2018 15:32:31 +0200
- Subject: [PATCH 3/4] LZWDecodeCompat(): fix potential index-out-of-bounds
- write. Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 /
- CVE-2018-8905
-
- The fix consists in using the similar code LZWDecode() to validate we
- don't write outside of the output buffer.
- ---
- libtiff/tif_lzw.c | 18 ++++++++++++------
- 1 file changed, 12 insertions(+), 6 deletions(-)
-
- diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
- index bc8f9c8..186ea3c 100644
- --- a/libtiff/tif_lzw.c
- +++ b/libtiff/tif_lzw.c
- @@ -604,6 +604,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
- char *tp;
- unsigned char *bp;
- int code, nbits;
- + int len;
- long nextbits, nextdata, nbitsmask;
- code_t *codep, *free_entp, *maxcodep, *oldcodep;
-
- @@ -755,13 +756,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
- } while (--occ);
- break;
- }
- - assert(occ >= codep->length);
- - op += codep->length;
- - occ -= codep->length;
- - tp = op;
- + len = codep->length;
- + tp = op + len;
- do {
- - *--tp = codep->value;
- - } while( (codep = codep->next) != NULL );
- + int t;
- + --tp;
- + t = codep->value;
- + codep = codep->next;
- + *tp = (char)t;
- + } while (codep && tp > op);
- + assert(occ >= len);
- + op += len;
- + occ -= len;
- } else {
- *op++ = (char)code;
- occ--;
- --
- 2.17.0
-
|
