44 lines
1.8 KiB
Diff
44 lines
1.8 KiB
Diff
diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c
|
|
index 41f7dfd77..8603ff026 100644
|
|
--- a/third_party/libtiff/tif_getimage.c
|
|
+++ b/third_party/libtiff/tif_getimage.c
|
|
@@ -723,6 +723,7 @@ static int gtTileContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w,
|
|
uint32_t this_tw, tocol;
|
|
int32_t this_toskew, leftmost_toskew;
|
|
int32_t leftmost_fromskew;
|
|
+ int64_t safeskew;
|
|
uint32_t leftmost_tw;
|
|
tmsize_t bufsize;
|
|
|
|
@@ -792,9 +793,28 @@ static int gtTileContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w,
|
|
/*
|
|
* Rightmost tile is clipped on right side.
|
|
*/
|
|
- fromskew = tw - (w - tocol);
|
|
+ safeskew = tw;
|
|
+ safeskew -= w;
|
|
+ safeskew += tocol;
|
|
+ if (safeskew > INT_MAX || safeskew < INT_MIN)
|
|
+ {
|
|
+ _TIFFfree(buf);
|
|
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s",
|
|
+ "Invalid skew");
|
|
+ return (0);
|
|
+ }
|
|
+ fromskew = safeskew;
|
|
this_tw = tw - fromskew;
|
|
- this_toskew = toskew + fromskew;
|
|
+ safeskew = toskew;
|
|
+ safeskew += fromskew;
|
|
+ if (safeskew > INT_MAX || safeskew < INT_MIN)
|
|
+ {
|
|
+ _TIFFfree(buf);
|
|
+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s",
|
|
+ "Invalid skew");
|
|
+ return (0);
|
|
+ }
|
|
+ this_toskew = safeskew;
|
|
}
|
|
tmsize_t roffset = (tmsize_t)y * w + tocol;
|
|
(*put)(img, raster + roffset, tocol, y, this_tw, nrow, fromskew,
|