From 28018a20a475a39c07c191543a3637291f085207 Mon Sep 17 00:00:00 2001
From: Andrey Kiselev <[EMAIL REDACTED]>
Date: Wed, 3 Sep 2008 07:17:23 +0000
Subject: [PATCH] Properly zero out the codetable. As per bug
http://bugzilla.maptools.org/show_bug.cgi?id=1929
---
libtiff/tif_lzw.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
index 6471cf42..5a964520 100644
--- a/libtiff/tif_lzw.c
+++ b/libtiff/tif_lzw.c
@@ -1,4 +1,4 @@
-/* $Id: tif_lzw.c,v 1.29.2.2 2008-09-03 07:09:09 dron Exp $ */
+/* $Id: tif_lzw.c,v 1.29.2.3 2008-09-03 07:17:23 dron Exp $ */
/*
* Copyright (c) 1988-1997 Sam Leffler
@@ -224,7 +224,8 @@ LZWSetupDecode(TIFF* tif)
if (sp->dec_codetab == NULL) {
sp->dec_codetab = (code_t*)_TIFFmalloc(CSIZE*sizeof (code_t));
if (sp->dec_codetab == NULL) {
- TIFFErrorExt(tif->tif_clientdata, module, "No space for LZW code table");
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "No space for LZW code table");
return (0);
}
/*
@@ -237,6 +238,11 @@ LZWSetupDecode(TIFF* tif)
sp->dec_codetab[code].length = 1;
sp->dec_codetab[code].next = NULL;
} while (code--);
+ /*
+ * Zero-out the unused entries
+ */
+ _TIFFmemset(&sp->dec_codetab[CODE_CLEAR], 0,
+ (CODE_FIRST - CODE_CLEAR) * sizeof (code_t));
}
return (1);
}
@@ -422,6 +428,12 @@ LZWDecode(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
NextCode(tif, sp, bp, code, GetNextCode);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = (char)code, occ--;
oldcodep = sp->dec_codetab + code;
continue;
@@ -620,6 +632,12 @@ LZWDecodeCompat(TIFF* tif, tidata_t op0, tsize_t occ0, tsample_t s)
NextCode(tif, sp, bp, code, GetNextCodeCompat);
if (code == CODE_EOI)
break;
+ if (code == CODE_CLEAR) {
+ TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+ "LZWDecode: Corrupted LZW table at scanline %d",
+ tif->tif_row);
+ return (0);
+ }
*op++ = code, occ--;
oldcodep = sp->dec_codetab + code;
continue;