Skip to content

Commit badb59e

Browse files
authored
Potential heap-buffer-overflow fix (#108)
TIFF files in PHOTOMETRIC_MINISWHITE or PHOTOMETRIC_MINISBLACK modes (monochrome) with more than one sample per pixel caused a crash. Fixes issue #107
1 parent ee17c56 commit badb59e

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

cupsfilters/image-tiff.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -353,9 +353,13 @@ _cfImageReadTIFF(
353353
// Allocate input and output buffers...
354354
//
355355

356+
int multi_pixel = (photometric != PHOTOMETRIC_MINISWHITE &&
357+
photometric != PHOTOMETRIC_MINISBLACK &&
358+
(samples > 1 || photometric == PHOTOMETRIC_PALETTE));
359+
356360
if (orientation < ORIENTATION_LEFTTOP)
357361
{
358-
if (samples > 1 || photometric == PHOTOMETRIC_PALETTE)
362+
if (multi_pixel)
359363
pstep = xdir * 3;
360364
else
361365
pstep = xdir;
@@ -378,7 +382,7 @@ _cfImageReadTIFF(
378382
}
379383
else
380384
{
381-
if (samples > 1 || photometric == PHOTOMETRIC_PALETTE)
385+
if (multi_pixel)
382386
pstep = ydir * 3;
383387
else
384388
pstep = ydir;

0 commit comments

Comments
 (0)