https://github.com/libsdl-org/libtiff/commit/d00c0228b5715b0549cd4be6bcd688f834cca809
From d00c0228b5715b0549cd4be6bcd688f834cca809 Mon Sep 17 00:00:00 2001
From: Lee Howard <[EMAIL REDACTED]>
Date: Wed, 15 Dec 2010 00:22:05 +0000
Subject: [PATCH] * tools/gif2tiff.c: fix buffer overrun
http://bugzilla.maptools.org/show_bug.cgi?id=2270
---
ChangeLog | 7 ++++++-
tools/gif2tiff.c | 6 +++++-
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 885c6b9c..256b4810 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,9 @@
-2010-12-13 Lee Howard <faxguy@howardsilvan.com>
+2010-12-14 Lee Howard <faxguy@howardsilvan.com>
+
+ * tools/gif2tiff.c: fix buffer overrun
+ http://bugzilla.maptools.org/show_bug.cgi?id=2270
+
+2010-12-14 Lee Howard <faxguy@howardsilvan.com>
* libtiff/tif_jpeg.c: reduce usage of JCS_UNKNOWN in order
to improve compatibility with various viewers
diff --git a/tools/gif2tiff.c b/tools/gif2tiff.c
index 9c2cfa4d..6035a794 100644
--- a/tools/gif2tiff.c
+++ b/tools/gif2tiff.c
@@ -1,4 +1,4 @@
-/* $Id: gif2tiff.c,v 1.8.2.1 2010-06-08 18:50:44 bfriesen Exp $ */
+/* $Id: gif2tiff.c,v 1.8.2.2 2010-12-15 00:22:05 faxguy Exp $ */
/*
* Copyright (c) 1990-1997 Sam Leffler
@@ -503,6 +503,10 @@ rasterize(int interleaved, char* mode)
strip = 0;
stripsize = TIFFStripSize(tif);
for (row=0; row<height; row += rowsperstrip) {
+ if (rowsperstrip > height-row) {
+ rowsperstrip = height-row;
+ stripsize = TIFFVStripSize(tif, rowsperstrip);
+ }
if (TIFFWriteEncodedStrip(tif, strip, newras+row*width, stripsize) < 0)
break;
strip++;