26 lines
954 B
Diff
26 lines
954 B
Diff
|
Fix CVE-2016-5321.
|
||
|
|
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5321
|
||
|
|
http://bugzilla.maptools.org/show_bug.cgi?id=2558
|
||
|
|
|
||
|
|
Patch extracted from upstream CVS repo with:
|
||
|
|
$ cvs diff -u -r1.35 -r1.36 tools/tiffcrop.c
|
||
|
|
|
||
|
|
Index: tools/tiffcrop.c
|
||
|
|
===================================================================
|
||
|
|
RCS file: /cvs/maptools/cvsroot/libtiff/tools/tiffcrop.c,v
|
||
|
|
retrieving revision 1.35
|
||
|
|
retrieving revision 1.36
|
||
|
|
diff -u -r1.35 -r1.36
|
||
|
|
--- libtiff/tools/tiffcrop.c 19 Aug 2015 02:31:04 -0000 1.35
|
||
|
|
+++ libtiff/tools/tiffcrop.c 11 Jul 2016 21:26:03 -0000 1.36
|
||
|
|
@@ -989,7 +989,7 @@
|
||
|
|
nrow = (row + tl > imagelength) ? imagelength - row : tl;
|
||
|
|
for (col = 0; col < imagewidth; col += tw)
|
||
|
|
{
|
||
|
|
- for (s = 0; s < spp; s++)
|
||
|
|
+ for (s = 0; s < spp && s < MAX_SAMPLES; s++)
|
||
|
|
{ /* Read each plane of a tile set into srcbuffs[s] */
|
||
|
|
tbytes = TIFFReadTile(in, srcbuffs[s], col, row, 0, s);
|
||
|
|
if (tbytes < 0 && !ignore)
|