From 3b727a6b17db9d8a0d2fd8a0f8cc3162df442681 Mon Sep 17 00:00:00 2001
From: Even Rouault <[EMAIL REDACTED]>
Date: Tue, 16 Aug 2022 10:40:07 +0200
Subject: [PATCH 1/2] tif_dirread.c: silence Coverity Scan false positive
warnings about out-of-bounds access (CID 1491182, 1491186)
---
libtiff/tif_dirread.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 8f3fc28d..1a45b35b 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -6978,9 +6978,11 @@ static int _TIFFFetchStrileValue(TIFF* tif,
{
td->td_stripoffsetbyteallocsize = nStripArrayAllocNew;
/* Initialize new entries to ~0 / -1 */
+ /* coverity[overrun-buffer-arg] */
memset(td->td_stripoffset_p + nStripArrayAllocBefore,
0xFF,
(td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) * sizeof(uint64_t) );
+ /* coverity[overrun-buffer-arg] */
memset(td->td_stripbytecount_p + nStripArrayAllocBefore,
0xFF,
(td->td_stripoffsetbyteallocsize - nStripArrayAllocBefore) * sizeof(uint64_t) );
From c5c9864714f54ee61bbff7d00b90fa6af509afbd Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Tue, 16 Aug 2022 10:43:47 +0200
Subject: [PATCH 2/2] tif_zip.c: silence Coverity Scan false positive warnings
about out-of-bounds access (CID 1491190, 1491197, 1491201)
---
libtiff/tif_zip.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libtiff/tif_zip.c b/libtiff/tif_zip.c
index be35e49b..f5caf0ff 100644
--- a/libtiff/tif_zip.c
+++ b/libtiff/tif_zip.c
@@ -242,6 +242,7 @@ ZIPDecode(TIFF* tif, uint8_t* op, tmsize_t occ, uint16_t s)
uInt avail_out_before = (uint64_t)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
sp->stream.avail_in = avail_in_before;
sp->stream.avail_out = avail_out_before;
+ /* coverity[overrun-buffer-arg] */
state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
tif->tif_rawcc -= (avail_in_before - sp->stream.avail_in);
occ -= (avail_out_before - sp->stream.avail_out);
@@ -432,6 +433,7 @@ ZIPEncode(TIFF* tif, uint8_t* bp, tmsize_t cc, uint16_t s)
do {
uInt avail_in_before = (uint64_t)cc <= 0xFFFFFFFFU ? (uInt)cc : 0xFFFFFFFFU;
sp->stream.avail_in = avail_in_before;
+ /* coverity[overrun-buffer-arg] */
if (deflate(&sp->stream, Z_NO_FLUSH) != Z_OK) {
TIFFErrorExt(tif->tif_clientdata, module,
"Encoder error: %s",