https://github.com/libsdl-org/libtiff/commit/2159caf37ebaa9df40975bdeea907f97f166af22
From 2159caf37ebaa9df40975bdeea907f97f166af22 Mon Sep 17 00:00:00 2001
From: Andrey Kiselev <[EMAIL REDACTED]>
Date: Thu, 8 Jul 2010 09:39:29 +0000
Subject: [PATCH] Fixed ID buffer filling in t2p_write_pdf_trailer(), thanks to
Dmitry V. Levin.
---
ChangeLog | 5 +++++
tools/tiff2pdf.c | 5 ++---
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index fbd6f565..b27b4036 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2010-07-08 Andrey Kiselev <dron@ak4719.spb.edu>
+
+ * tools/tiff2pdf.c: Fixed ID buffer filling in
+ t2p_write_pdf_trailer(), thanks to Dmitry V. Levin.
+
2010-07-07 Andrey Kiselev <dron@ak4719.spb.edu>
* lintiff/tif_dirread.c: Really reset the tag count in CheckDirCount()
diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
index 0a75a6ce..a9590180 100644
--- a/tools/tiff2pdf.c
+++ b/tools/tiff2pdf.c
@@ -1,4 +1,4 @@
-/* $Id: tiff2pdf.c,v 1.37.2.14 2010-06-30 16:05:56 dron Exp $
+/* $Id: tiff2pdf.c,v 1.37.2.15 2010-07-08 09:39:29 dron Exp $
*
* tiff2pdf - converts a TIFF image to a PDF document
*
@@ -5050,9 +5050,8 @@ tsize_t t2p_write_pdf_trailer(T2P* t2p, TIFF* output)
int buflen = 0;
size_t i = 0;
- for (i = 0; i < sizeof(t2p->pdf_fileid); i += 8)
+ for (i = 0; i < sizeof(t2p->pdf_fileid) - 8; i += 8)
snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand());
- t2p->pdf_fileid[sizeof(t2p->pdf_fileid) - 1] = '\0';
written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17);
buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1));