Apply security fixes to libtiff that are not in 4.0.6.

third_party/libtiff/tif_luv.c

 /* $Id: tif_luv.c,v 1.40 2015-06-21 01:09:09 bfriesen Exp $ */
 
 /*
  * Copyright (c) 1997 Greg Ward Larson
  * Copyright (c) 1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
@@ skipping 184 matching lines @@
         int rc;
 
         assert(s == 0);
         assert(sp != NULL);
 
         npixels = occ / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
                 tp = (int16*) op;
         else {
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 tp = (int16*) sp->tbuf;
         }
         _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
 
         bp = (unsigned char*) tif->tif_rawcp;
         cc = tif->tif_rawcc;
         /* get each byte string */
         for (shft = 2*8; (shft -= 8) >= 0; ) {
-                for (i = 0; i < npixels && cc > 0; )
+                for (i = 0; i < npixels && cc > 0; ) {
                         if (*bp >= 128) {               /* run */
-                                rc = *bp++ + (2-128);   /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+                                if( cc < 2 )
+                                        break;
+                                rc = *bp++ + (2-128);
                                 b = (int16)(*bp++ << shft);
                                 cc -= 2;
                                 while (rc-- && i < npixels)
                                         tp[i++] |= b;
                         } else {                        /* non-run */
                                 rc = *bp++;             /* nul is noop */
                                 while (--cc && rc-- && i < npixels)
                                         tp[i++] |= (int16)*bp++ << shft;
                         }
+                }
                 if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
                         TIFFErrorExt(tif->tif_clientdata, module,
                             "Not enough data at row %lu (short %I64d pixels)",
                                      (unsigned long) tif->tif_row,
                                      (unsigned __int64) (npixels - i));
 #else
                         TIFFErrorExt(tif->tif_clientdata, module,
                             "Not enough data at row %lu (short %llu pixels)",
                                      (unsigned long) tif->tif_row,
@@ skipping 25 matching lines @@
         uint32* tp;
 
         assert(s == 0);
         assert(sp != NULL);
 
         npixels = occ / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                 tp = (uint32 *)op;
         else {
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 tp = (uint32 *) sp->tbuf;
         }
         /* copy to array of uint32 */
         bp = (unsigned char*) tif->tif_rawcp;
         cc = tif->tif_rawcc;
-        for (i = 0; i < npixels && cc > 0; i++) {
+        for (i = 0; i < npixels && cc >= 3; i++) {
                 tp[i] = bp[0] << 16 | bp[1] << 8 | bp[2];
                 bp += 3;
                 cc -= 3;
         }
         tif->tif_rawcp = (uint8*) bp;
         tif->tif_rawcc = cc;
         if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
                 TIFFErrorExt(tif->tif_clientdata, module,
                         "Not enough data at row %lu (short %I64d pixels)",
@@ skipping 30 matching lines @@
 
         assert(s == 0);
         sp = DecoderState(tif);
         assert(sp != NULL);
 
         npixels = occ / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                 tp = (uint32*) op;
         else {
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 tp = (uint32*) sp->tbuf;
         }
         _TIFFmemset((void*) tp, 0, npixels*sizeof (tp[0]));
 
         bp = (unsigned char*) tif->tif_rawcp;
         cc = tif->tif_rawcc;
         /* get each byte string */
         for (shft = 4*8; (shft -= 8) >= 0; ) {
-                for (i = 0; i < npixels && cc > 0; )
+                for (i = 0; i < npixels && cc > 0; ) {
                         if (*bp >= 128) {               /* run */
+                                if( cc < 2 )
+                                        break;
                                 rc = *bp++ + (2-128);
                                 b = (uint32)*bp++ << shft;
-                                cc -= 2;                /* TODO: potential input buffer overrun when decoding corrupt or truncated data */
+                                cc -= 2;
                                 while (rc-- && i < npixels)
                                         tp[i++] |= b;
                         } else {                        /* non-run */
                                 rc = *bp++;             /* nul is noop */
                                 while (--cc && rc-- && i < npixels)
                                         tp[i++] |= (uint32)*bp++ << shft;
                         }
+                }
                 if (i != npixels) {
 #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
                         TIFFErrorExt(tif->tif_clientdata, module,
                         "Not enough data at row %lu (short %I64d pixels)",
                                      (unsigned long) tif->tif_row,
                                      (unsigned __int64) (npixels - i));
 #else
                         TIFFErrorExt(tif->tif_clientdata, module,
                         "Not enough data at row %lu (short %llu pixels)",
                                      (unsigned long) tif->tif_row,
@@ skipping 47 matching lines @@
                 bp += rowlen, cc -= rowlen;
         return (cc == 0);
 }
 
 /*
  * Encode a row of 16-bit pixels.
  */
 static int
 LogL16Encode(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+        static const char module[] = "LogL16Encode";
         LogLuvState* sp = EncoderState(tif);
         int shft;
         tmsize_t i;
         tmsize_t j;
         tmsize_t npixels;
         uint8* op;
         int16* tp;
         int16 b;
         tmsize_t occ;
         int rc=0, mask;
         tmsize_t beg;
 
         assert(s == 0);
         assert(sp != NULL);
         npixels = cc / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_16BIT)
                 tp = (int16*) bp;
         else {
                 tp = (int16*) sp->tbuf;
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 (*sp->tfunc)(sp, bp, npixels);
         }
         /* compress each byte string */
         op = tif->tif_rawcp;
         occ = tif->tif_rawdatasize - tif->tif_rawcc;
         for (shft = 2*8; (shft -= 8) >= 0; )
                 for (i = 0; i < npixels; i += rc) {
                         if (occ < 4) {
                                 tif->tif_rawcp = op;
                                 tif->tif_rawcc = tif->tif_rawdatasize - occ;
@@ skipping 52 matching lines @@
 
         return (1);
 }
 
 /*
  * Encode a row of 24-bit pixels.
  */
 static int
 LogLuvEncode24(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+        static const char module[] = "LogLuvEncode24";
         LogLuvState* sp = EncoderState(tif);
         tmsize_t i;
         tmsize_t npixels;
         tmsize_t occ;
         uint8* op;
         uint32* tp;
 
         assert(s == 0);
         assert(sp != NULL);
         npixels = cc / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                 tp = (uint32*) bp;
         else {
                 tp = (uint32*) sp->tbuf;
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 (*sp->tfunc)(sp, bp, npixels);
         }
         /* write out encoded pixels */
         op = tif->tif_rawcp;
         occ = tif->tif_rawdatasize - tif->tif_rawcc;
         for (i = npixels; i--; ) {
                 if (occ < 3) {
                         tif->tif_rawcp = op;
                         tif->tif_rawcc = tif->tif_rawdatasize - occ;
                         if (!TIFFFlushData1(tif))
@@ skipping 11 matching lines @@
 
         return (1);
 }
 
 /*
  * Encode a row of 32-bit pixels.
  */
 static int
 LogLuvEncode32(TIFF* tif, uint8* bp, tmsize_t cc, uint16 s)
 {
+        static const char module[] = "LogLuvEncode32";
         LogLuvState* sp = EncoderState(tif);
         int shft;
         tmsize_t i;
         tmsize_t j;
         tmsize_t npixels;
         uint8* op;
         uint32* tp;
         uint32 b;
         tmsize_t occ;
         int rc=0, mask;
         tmsize_t beg;
 
         assert(s == 0);
         assert(sp != NULL);
 
         npixels = cc / sp->pixel_size;
 
         if (sp->user_datafmt == SGILOGDATAFMT_RAW)
                 tp = (uint32*) bp;
         else {
                 tp = (uint32*) sp->tbuf;
-                assert(sp->tbuflen >= npixels);
+                if(sp->tbuflen < npixels) {
+                        TIFFErrorExt(tif->tif_clientdata, module,
+                                                 "Translation buffer too short");
+                        return (0);
+                }
                 (*sp->tfunc)(sp, bp, npixels);
         }
         /* compress each byte string */
         op = tif->tif_rawcp;
         occ = tif->tif_rawdatasize - tif->tif_rawcc;
         for (shft = 4*8; (shft -= 8) >= 0; )
                 for (i = 0; i < npixels; i += rc) {
                         if (occ < 4) {
                                 tif->tif_rawcp = op;
                                 tif->tif_rawcc = tif->tif_rawdatasize - occ;
@@ skipping 1100 matching lines @@
 #endif /* LOGLUV_SUPPORT */
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */