From fcfa5b516c43c0a8eabede226ec8df7852328339 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 5 Nov 2023 04:42:11 +0800 Subject: [PATCH 2/2] TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of col/row (fixes #622) --- libtiff/tif_getimage.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 9a2e0c5..ca4d227 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -2942,6 +2942,13 @@ TIFFReadRGBAStripExt(TIFF* tif, uint32_t row, uint32_t * raster, int stop_on_err } if (TIFFRGBAImageOK(tif, emsg) && TIFFRGBAImageBegin(&img, tif, stop_on_error, emsg)) { + if (row >= img.height) + { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), + "Invalid row passed to TIFFReadRGBAStrip()."); + TIFFRGBAImageEnd(&img); + return (0); + } img.row_offset = row; img.col_offset = 0; @@ -3018,6 +3025,14 @@ TIFFReadRGBATileExt(TIFF* tif, uint32_t col, uint32_t row, uint32_t * raster, in return( 0 ); } + if (col >= img.width || row >= img.height) + { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), + "Invalid row/col passed to TIFFReadRGBATile()."); + TIFFRGBAImageEnd(&img); + return (0); + } + /* * The TIFFRGBAImageGet() function doesn't allow us to get off the * edge of the image, even to fill an otherwise valid tile. So we -- 2.33.0