tiff-3.9.1-CVE-2011-0191.diff 656 B

1234567891011121314
  1. --- libtiff/tif_dir.c 2011-04-04 05:58:54.000000000 -0400
  2. +++ libtiff/tif_dir.c.oden 2011-04-04 05:59:08.000000000 -0400
  3. @@ -370,6 +370,10 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
  4. case TIFFTAG_YCBCRSUBSAMPLING:
  5. td->td_ycbcrsubsampling[0] = (uint16) va_arg(ap, int);
  6. td->td_ycbcrsubsampling[1] = (uint16) va_arg(ap, int);
  7. + if (td->td_ycbcrsubsampling[0] > 4)
  8. + td->td_ycbcrsubsampling[0] = (td->td_compression == 7) ? 1 : 2;
  9. + if (td->td_ycbcrsubsampling[1] > 4)
  10. + td->td_ycbcrsubsampling[1] = (td->td_compression == 7) ? 1 : 2;
  11. break;
  12. case TIFFTAG_TRANSFERFUNCTION:
  13. v = (td->td_samplesperpixel - td->td_extrasamples) > 1 ? 3 : 1;