blob: b15c1d08797246c86c4bf3ec0b5189ef9fb54cf2 (
about) (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
We omit the ChangeLog changes below, since they do not apply cleanly.
From 6ee5059cd3ac8d82714a1ab1321399b88539abf0 Mon Sep 17 00:00:00 2001
From: Cristy <urban-warrior@imagemagick.org>
Date: Mon, 30 Nov 2020 16:26:59 +0000
Subject: [PATCH] possible TIFF related-heap buffer overflow (alert & POC by
Hardik Shah)
---
ChangeLog | 6 ++++++
coders/tiff.c | 2 +-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/coders/tiff.c b/coders/tiff.c
index e98f927ab..1eecf17ae 100644
--- a/coders/tiff.c
+++ b/coders/tiff.c
@@ -1975,7 +1975,7 @@ static Image *ReadTIFFImage(const ImageInfo *image_info,
extent+=image->columns*sizeof(uint32);
#endif
strip_pixels=(unsigned char *) AcquireQuantumMemory(extent,
- sizeof(*strip_pixels));
+ 2*sizeof(*strip_pixels));
if (strip_pixels == (unsigned char *) NULL)
ThrowTIFFException(ResourceLimitError,"MemoryAllocationFailed");
(void) memset(strip_pixels,0,extent*sizeof(*strip_pixels));
|
