Internal libtiff: resync with upstream

xuncanzhe · Nov 12, 2020 · cf0a249 · cf0a249
1 parent 330e3c7
commit cf0a249
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 6 deletions.
diff --git a/gdal/frmts/gtiff/libtiff/tif_dir.c b/gdal/frmts/gtiff/libtiff/tif_dir.c
@@ -394,7 +394,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
 			if (tif->tif_mode != O_RDONLY)
 				goto badvalue32;
 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
-				"Nonstandard tile width %d, convert file", v32);
+				"Nonstandard tile width %u, convert file", v32);
 		}
 		td->td_tilewidth = v32;
 		tif->tif_flags |= TIFF_ISTILED;
@@ -405,7 +405,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
 			if (tif->tif_mode != O_RDONLY)
 				goto badvalue32;
 			TIFFWarningExt(tif->tif_clientdata, tif->tif_name,
-			    "Nonstandard tile length %d, convert file", v32);
+			    "Nonstandard tile length %u, convert file", v32);
 		}
 		td->td_tilelength = v32;
 		tif->tif_flags |= TIFF_ISTILED;

diff --git a/gdal/frmts/gtiff/libtiff/tif_getimage.c b/gdal/frmts/gtiff/libtiff/tif_getimage.c
@@ -29,6 +29,7 @@
  */
 #include "tiffiop.h"
 #include <stdio.h>
+#include <limits.h>
 
 static int gtTileContig(TIFFRGBAImage*, uint32*, uint32, uint32);
 static int gtTileSeparate(TIFFRGBAImage*, uint32*, uint32, uint32);
@@ -645,12 +646,20 @@ gtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
 
     flip = setorientation(img);
     if (flip & FLIP_VERTICALLY) {
-	    y = h - 1;
-	    toskew = -(int32)(tw + w);
+        if ((tw + w) > INT_MAX) {
+            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
+            return (0);
+        }
+        y = h - 1;
+        toskew = -(int32)(tw + w);
     }
     else {
-	    y = 0;
-	    toskew = -(int32)(tw - w);
+        if (tw > (INT_MAX + w)) {
+            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)");
+            return (0);
+        }
+        y = 0;
+        toskew = -(int32)(tw - w);
     }
 
     /*
@@ -936,6 +945,10 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)
 
 	flip = setorientation(img);
 	if (flip & FLIP_VERTICALLY) {
+		if ( w > 0x7FFFFFFFu ) {
+            TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow");
+		    return (0);
+		}
 		y = h - 1;
 		toskew = -(int32)(w + w);
 	} else {