16 lines
877 B
Diff
16 lines
877 B
Diff
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp
|
|
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:47.713009853 +0200
|
|
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginTIFF.cpp 2023-09-28 19:34:48.043006563 +0200
|
|
@@ -2142,6 +2142,11 @@ Load(FreeImageIO *io, fi_handle handle,
|
|
uint32_t tileRowSize = (uint32_t)TIFFTileRowSize(tif);
|
|
uint32_t imageRowSize = (uint32_t)TIFFScanlineSize(tif);
|
|
|
|
+ if (width / tileWidth * tileRowSize * 8 > bitspersample * samplesperpixel * width) {
|
|
+ free(tileBuffer);
|
|
+ throw "Corrupted tiled TIFF file";
|
|
+ }
|
|
+
|
|
|
|
// In the tiff file the lines are saved from up to down
|
|
// In a DIB the lines must be saved from down to up
|