libtiff: TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize output buffer if setupdecode fails

From 28c38d648b64a66c3218778c4745225fe3e3a06d Mon Sep 17 00:00:00 2001
From: Even Rouault <[EMAIL REDACTED]>
Date: Sun, 26 May 2024 19:47:16 +0200
Subject: [PATCH] TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize
 output buffer if setupdecode fails

Fixes #375
---
 libtiff/tif_read.c | 39 ++++++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
index df4bac69..7efab59c 100644
--- a/libtiff/tif_read.c
+++ b/libtiff/tif_read.c
@@ -464,6 +464,10 @@ int TIFFReadScanline(TIFF *tif, void *buf, uint32_t row, uint16_t sample)
         if (e)
             (*tif->tif_postdecode)(tif, (uint8_t *)buf, tif->tif_scanlinesize);
     }
+    else
+    {
+        memset(buf, 0, (size_t)tif->tif_scanlinesize);
+    }
     return (e > 0 ? 1 : -1);
 }
 
@@ -549,7 +553,10 @@ tmsize_t TIFFReadEncodedStrip(TIFF *tif, uint32_t strip, void *buf,
     if ((size != (tmsize_t)(-1)) && (size < stripsize))
         stripsize = size;
     if (!TIFFFillStrip(tif, strip))
+    {
+        memset(buf, 0, (size_t)stripsize);
         return ((tmsize_t)(-1));
+    }
     if ((*tif->tif_decodestrip)(tif, buf, stripsize, plane) <= 0)
         return ((tmsize_t)(-1));
     (*tif->tif_postdecode)(tif, buf, stripsize);
@@ -967,9 +974,13 @@ tmsize_t TIFFReadEncodedTile(TIFF *tif, uint32_t tile, void *buf, tmsize_t size)
         size = tilesize;
     else if (size > tilesize)
         size = tilesize;
-    if (TIFFFillTile(tif, tile) &&
-        (*tif->tif_decodetile)(tif, (uint8_t *)buf, size,
-                               (uint16_t)(tile / td->td_stripsperimage)))
+    if (!TIFFFillTile(tif, tile))
+    {
+        memset(buf, 0, (size_t)size);
+        return ((tmsize_t)(-1));
+    }
+    else if ((*tif->tif_decodetile)(tif, (uint8_t *)buf, size,
+                                    (uint16_t)(tile / td->td_stripsperimage)))
     {
         (*tif->tif_postdecode)(tif, (uint8_t *)buf, size);
         return (size);
@@ -1555,9 +1566,14 @@ int TIFFReadFromUserBuffer(TIFF *tif, uint32_t strile, void *inbuf,
 
     if (TIFFIsTiled(tif))
     {
-        if (!TIFFStartTile(tif, strile) ||
-            !(*tif->tif_decodetile)(tif, (uint8_t *)outbuf, outsize,
-                                    (uint16_t)(strile / td->td_stripsperimage)))
+        if (!TIFFStartTile(tif, strile))
+        {
+            ret = 0;
+            memset(outbuf, 0, (size_t)outsize);
+        }
+        else if (!(*tif->tif_decodetile)(
+                     tif, (uint8_t *)outbuf, outsize,
+                     (uint16_t)(strile / td->td_stripsperimage)))
         {
             ret = 0;
         }
@@ -1577,9 +1593,14 @@ int TIFFReadFromUserBuffer(TIFF *tif, uint32_t strile, void *inbuf,
         {
             stripsperplane =
                 TIFFhowmany_32_maxuint_compat(td->td_imagelength, rowsperstrip);
-            if (!TIFFStartStrip(tif, strile) ||
-                !(*tif->tif_decodestrip)(tif, (uint8_t *)outbuf, outsize,
-                                         (uint16_t)(strile / stripsperplane)))
+            if (!TIFFStartStrip(tif, strile))
+            {
+                ret = 0;
+                memset(outbuf, 0, (size_t)outsize);
+            }
+            else if (!(*tif->tif_decodestrip)(
+                         tif, (uint8_t *)outbuf, outsize,
+                         (uint16_t)(strile / stripsperplane)))
             {
                 ret = 0;
             }