libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.

libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.

The patch (https://codereview.chromium.org/2284063002) for Issue 618267
was insufficient. The integer overflow still could be triggered and could
lead to heap buffer overflow.

This CL strengthens integer overflow check in function _TIFFCheckRealloc.

BUG=chromium:654169
R=ochang@chromium.org, tsepez@chromium.org, dsinclair@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/24ba0a2ef48d7be37f02056d20bb8c625f641939

[Ke Liu, 2016-10-08 04:06:02]

The patch (https://codereview.chromium.org/2284063002) for Issue 618267
(https://bugs.chromium.org/p/chromium/issues/detail?id=618267) was insufficient.
The integer overflow still could be triggered and could lead to heap buffer
overflow.

This CL strengthens integer overflow check in function _TIFFCheckRealloc.

[Tom Sepez, 2016-10-10 17:28:42]

The CQ bit was checked by tsepez@chromium.org

[Tom Sepez, 2016-10-10 17:28:42]

lgtm

[commit-bot: I haz the power, 2016-10-10 17:28:48]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-10 17:58:28]

Description was changed from

==========
libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.

The patch (https://codereview.chromium.org/2284063002) for Issue 618267
was insufficient. The integer overflow still could be triggered and could
lead to heap buffer overflow.

This CL strengthens integer overflow check in function _TIFFCheckRealloc.

BUG=chromium:654169
R=ochang@chromium.org, tsepez@chromium.org, dsinclair@chromium.org
==========

to

==========
libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.

The patch (https://codereview.chromium.org/2284063002) for Issue 618267
was insufficient. The integer overflow still could be triggered and could
lead to heap buffer overflow.

This CL strengthens integer overflow check in function _TIFFCheckRealloc.

BUG=chromium:654169
R=ochang@chromium.org, tsepez@chromium.org, dsinclair@chromium.org

Committed:
https://pdfium.googlesource.com/pdfium/+/24ba0a2ef48d7be37f02056d20bb8c625f64...
==========

[commit-bot: I haz the power, 2016-10-10 17:58:29]

Committed patchset #1 (id:1) as
https://pdfium.googlesource.com/pdfium/+/24ba0a2ef48d7be37f02056d20bb8c625f64...

[hong_zhang, 2016-10-17 18:07:37]

hong_zhang@foxitsoftware.com changed reviewers:
+ hong_zhang@foxitsoftware.com, stackexploit@gmail.com,
tracy_jiang@foxitsoftware.com

[hong_zhang, 2016-10-17 18:07:38]

Just a question. Thanks

https://codereview.chromium.org/2405693002/diff/1/third_party/libtiff/tif_aux.c
File third_party/libtiff/tif_aux.c (right):

https://codereview.chromium.org/2405693002/diff/1/third_party/libtiff/tif_aux...
third_party/libtiff/tif_aux.c:72: if (nmemb > 0 && elem_size > 0 &&
!_TIFFIfMultiplicationOverflow(nmemb, elem_size))
Hi, may I ask why? I thought tmsize_t is unsigned. So what effect does
"if(nmemb>0" take in addition to "if(nmemb" ?

[Tom Sepez, 2016-10-17 18:20:04]

https://codereview.chromium.org/2405693002/diff/1/third_party/libtiff/tif_aux.c
File third_party/libtiff/tif_aux.c (right):

https://codereview.chromium.org/2405693002/diff/1/third_party/libtiff/tif_aux...
third_party/libtiff/tif_aux.c:72: if (nmemb > 0 && elem_size > 0 &&
!_TIFFIfMultiplicationOverflow(nmemb, elem_size))

nmemb is tmsize_t.

tmsize_t is TIFF_SSIZE_T at 
https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/libtiff/t...

TIFF_SSIZE_T is always signed 
https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/libtiff/t...

(like ssize_t (with two s)).