Apply security fixes to libtiff that are not in 4.0.6.

third_party/libtiff/tif_getimage.c

 /* $Id: tif_getimage.c,v 1.90 2015-06-17 01:34:08 bfriesen Exp $ */
 
 /*
  * Copyright (c) 1991-1997 Sam Leffler
  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
@@ skipping 164 matching lines @@
                             td->td_compression != COMPRESSION_SGILOG24) {
                                 sprintf(emsg, "Sorry, LogLuv data must have %s=%d or %d",
                                     "Compression", COMPRESSION_SGILOG, COMPRESSION_SGILOG24);
                                 return (0);
                         }
                         if (td->td_planarconfig != PLANARCONFIG_CONTIG) {
                                 sprintf(emsg, "Sorry, can not handle LogLuv images with %s=%d",
                                     "Planarconfiguration", td->td_planarconfig);
                                 return (0);
                         }
-                        if( td->td_samplesperpixel != 3 )
+                        if( td->td_samplesperpixel != 3 || colorchannels != 3 )
             {
                 sprintf(emsg,
-                        "Sorry, can not handle image with %s=%d",
-                        "Samples/pixel", td->td_samplesperpixel);
+                        "Sorry, can not handle image with %s=%d, %s=%d",
+                        "Samples/pixel", td->td_samplesperpixel,
+                        "colorchannels", colorchannels);
                 return 0;
             }
                         break;
                 case PHOTOMETRIC_CIELAB:
-            if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
+            if( td->td_samplesperpixel != 3 || colorchannels != 3 || td->td_bitspersample != 8 )
             {
                 sprintf(emsg,
-                        "Sorry, can not handle image with %s=%d and %s=%d",
+                        "Sorry, can not handle image with %s=%d, %s=%d and %s=%d",
                         "Samples/pixel", td->td_samplesperpixel,
+                        "colorchannels", colorchannels,
                         "Bits/sample", td->td_bitspersample);
                 return 0;
             }
                         break;
                 default:
                         sprintf(emsg, "Sorry, can not handle image with %s=%d",
                             photoTag, photometric);
                         return (0);
         }
         return (1);
@@ skipping 39 matching lines @@
 int
 TIFFRGBAImageBegin(TIFFRGBAImage* img, TIFF* tif, int stop, char emsg[1024])
 {
         uint16* sampleinfo;
         uint16 extrasamples;
         uint16 planarconfig;
         uint16 compress;
         int colorchannels;
         uint16 *red_orig, *green_orig, *blue_orig;
         int n_color;
+        
+        if( !TIFFRGBAImageOK(tif, emsg) )
+                return 0;
 
         /* Initialize to normal values */
         img->row_offset = 0;
         img->col_offset = 0;
         img->redcmap = NULL;
         img->greencmap = NULL;
         img->bluecmap = NULL;
         img->req_orientation = ORIENTATION_BOTLEFT;     /* It is the default */
 
         img->tif = tif;
@@ skipping 2233 matching lines @@
  */
 static int
 PickContigCase(TIFFRGBAImage* img)
 {
         img->get = TIFFIsTiled(img->tif) ? gtTileContig : gtStripContig;
         img->put.contig = NULL;
         switch (img->photometric) {
                 case PHOTOMETRIC_RGB:
                         switch (img->bitspersample) {
                                 case 8:
-                                        if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
+                                        if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
+                                                img->samplesperpixel >= 4)
                                                 img->put.contig = putRGBAAcontig8bittile;
-                                        else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
+                                        else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
+                                                         img->samplesperpixel >= 4)
                                         {
                                                 if (BuildMapUaToAa(img))
                                                         img->put.contig = putRGBUAcontig8bittile;
                                         }
-                                        else
+                                        else if( img->samplesperpixel >= 3 )
                                                 img->put.contig = putRGBcontig8bittile;
                                         break;
                                 case 16:
-                                        if (img->alpha == EXTRASAMPLE_ASSOCALPHA)
+                                        if (img->alpha == EXTRASAMPLE_ASSOCALPHA &&
+                                                img->samplesperpixel >=4 )
                                         {
                                                 if (BuildMapBitdepth16To8(img))
                                                         img->put.contig = putRGBAAcontig16bittile;
                                         }
-                                        else if (img->alpha == EXTRASAMPLE_UNASSALPHA)
+                                        else if (img->alpha == EXTRASAMPLE_UNASSALPHA &&
+                                                         img->samplesperpixel >=4 )
                                         {
                                                 if (BuildMapBitdepth16To8(img) &&
                                                     BuildMapUaToAa(img))
                                                         img->put.contig = putRGBUAcontig16bittile;
                                         }
-                                        else
+                                        else if( img->samplesperpixel >=3 )
                                         {
                                                 if (BuildMapBitdepth16To8(img))
                                                         img->put.contig = putRGBcontig16bittile;
                                         }
                                         break;
                         }
                         break;
                 case PHOTOMETRIC_SEPARATED:
-                        if (buildMap(img)) {
+                        if (img->samplesperpixel >=4 && buildMap(img)) {
                                 if (img->bitspersample == 8) {
                                         if (!img->Map)
                                                 img->put.contig = putRGBcontig8bitCMYKtile;
                                         else
                                                 img->put.contig = putRGBcontig8bitCMYKMaptile;
                                 }
                         }
                         break;
                 case PHOTOMETRIC_PALETTE:
                         if (buildMap(img)) {
@@ skipping 75 matching lines @@
                                                         img->put.contig = putcontig8bitYCbCr12tile;
                                                         break;
                                                 case 0x11:
                                                         img->put.contig = putcontig8bitYCbCr11tile;
                                                         break;
                                         }
                                 }
                         }
                         break;
                 case PHOTOMETRIC_CIELAB:
-                        if (buildMap(img)) {
+                        if (img->samplesperpixel == 3 && buildMap(img)) {
                                 if (img->bitspersample == 8)
                                         img->put.contig = initCIELabConversion(img);
                                 break;
                         }
         }
         return ((img->get!=NULL) && (img->put.contig!=NULL));
 }
 
 /*
  * Select the appropriate conversion routine for unpacked data.
@@ skipping 270 matching lines @@
 }
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */