Apply security fixes to libtiff that are not in 4.0.6.

third_party/libtiff/tif_next.c

 /* $Id: tif_next.c,v 1.16 2014-12-29 12:09:11 erouault Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
@@ skipping 19 matching lines @@
  * TIFF Library.
  *
  * NeXT 2-bit Grey Scale Compression Algorithm Support
  */
 
 #define SETPIXEL(op, v) {                       \
         switch (npixels++ & 3) {                \
         case 0: op[0]  = (unsigned char) ((v) << 6); break;     \
         case 1: op[0] |= (v) << 4; break;       \
         case 2: op[0] |= (v) << 2; break;       \
-        case 3: *op++ |= (v);      break;       \
+        case 3: *op++ |= (v);      op_offset++; break;  \
         }                                       \
 }
 
 #define LITERALROW      0x00
 #define LITERALSPAN     0x40
 #define WHITE           ((1<<2)-1)
 
 static int
 NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
 {
@@ skipping 48 matching lines @@
                         _TIFFmemcpy(row+off, bp+4, n);
                         bp += 4+n;
                         cc -= 4+n;
                         break;
                 }
                 default: {
                         uint32 npixels = 0, grey;
                         uint32 imagewidth = tif->tif_dir.td_imagewidth;
             if( isTiled(tif) )
                 imagewidth = tif->tif_dir.td_tilewidth;
+            tmsize_t op_offset = 0;
 
                         /*
                          * The scanline is composed of a sequence of constant
                          * color ``runs''.  We shift into ``run mode'' and
                          * interpret bytes as codes of the form
                          * <color><npixels> until we've filled the scanline.
                          */
                         op = row;
                         for (;;) {
                                 grey = (uint32)((n>>6) & 0x3);
                                 n &= 0x3f;
                                 /*
                                  * Ensure the run does not exceed the scanline
                                  * bounds, potentially resulting in a security
                                  * issue.
                                  */
-                                while (n-- > 0 && npixels < imagewidth)
+                                while (n-- > 0 && npixels < imagewidth && op_offset < scanline)
                                         SETPIXEL(op, grey);
                                 if (npixels >= imagewidth)
                                         break;
+                if (op_offset >= scanline ) {
+                    TIFFErrorExt(tif->tif_clientdata, module, "Invalid data for scanline %ld",
+                        (long) tif->tif_row);
+                    return (0);
+                }
                                 if (cc == 0)
                                         goto bad;
                                 n = *bp++, cc--;
                         }
                         break;
                 }
                 }
         }
         tif->tif_rawcp = (uint8*) bp;
         tif->tif_rawcc = cc;
@@ skipping 33 matching lines @@
 #endif /* NEXT_SUPPORT */
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */