From aa6829cda019f56ed882b2db2d1e84c994412f9d Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Nikola=20Forr=C3=B3?= <nforro@redhat.com>

Date: Wed, 11 Jan 2017 12:58:22 +0100

Subject: [PATCH 3/5] Fix CVE-2016-9540

---

tools/tiffcp.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/tiffcp.c b/tools/tiffcp.c

index 8c696db..2903461 100644

--- a/tools/tiffcp.c

+++ b/tools/tiffcp.c

@@ -1330,7 +1330,7 @@ DECLAREreadFunc(readContigTilesIntoBuffer)

uint32 colb = 0;

uint32 col;

- for (col = 0; col < imagewidth; col += tw) {

+ for (col = 0; col < imagewidth && colb < imagew; col += tw) {

if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0

&& !ignore) {

TIFFError(TIFFFileName(in),

@@ -1515,7 +1515,7 @@ DECLAREwriteFunc(writeBufferToContigTiles)

uint32 colb = 0;

uint32 col;

- for (col = 0; col < imagewidth; col += tw) {

+ for (col = 0; col < imagewidth && colb < imagew; col += tw) {

/*

* Tile is clipped horizontally. Calculate

* visible portion and skewing factors.

--

2.7.4